Getting Data In

Exclude tar files in inputs.conf

tevgey23
Explorer

Hello,

Is there a way to "blacklist" or exclude tar.gz file with in a monitored directory in
the inputs.conf file.

For example.. I would like to monitoring /var/log/syslog/*
but not all the rotated tar files which have been created.
Just the .log file which have been created that day

Tags (1)
0 Karma
1 Solution

jtrucks
Splunk Employee
Splunk Employee

The docs at http://docs.splunk.com/Documentation/Splunk/6.0/admin/Inputsconf show under the Monitor section:

blacklist =
* If set, files from this input are NOT monitored if their path matches
the specified regex.
* Takes precedence over the deprecated _blacklist attribute, which functions the same way.

So in your case:

blacklist = *.tar.gz
--
Jesse Trucks
Minister of Magic

View solution in original post

jtrucks
Splunk Employee
Splunk Employee

The docs at http://docs.splunk.com/Documentation/Splunk/6.0/admin/Inputsconf show under the Monitor section:

blacklist =
* If set, files from this input are NOT monitored if their path matches
the specified regex.
* Takes precedence over the deprecated _blacklist attribute, which functions the same way.

So in your case:

blacklist = *.tar.gz
--
Jesse Trucks
Minister of Magic

ChrisG
Splunk Employee
Splunk Employee
0 Karma

jtrucks
Splunk Employee
Splunk Employee

Don't forget to mark it as accepted/answered!

--
Jesse Trucks
Minister of Magic
0 Karma

tevgey23
Explorer

Nice.. Thank you

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...