From the CLI, can I issue a blackout on a specific monitoring target and then later clear the blackout?

[skulcak]

i am unfamiliar with Splunk terminology. i want to issue a blackout/stop monitoring an Oracle instance alert_log while is is being duplicated from a backup, using some kind of command line interface.

[pdaigle_splunk]

Another thought here is leveraging the whitelist and blacklist parameter of the file monitoring:

http://docs.splunk.com/Documentation/Splunk/6.5.0/Data/Whitelistorblacklistspecificincomingdata

In essence you could modify the inputs.conf add in the blacklist parameter that includes the alert_log file names. Any time those pop up, they would automatically be handled with not being indexed at all into Splunk.

If you still needed the alert_log file on a regular basis you can always comment out the blacklist line then remove the "#" when you need to invoke it.

No, you cannot do this via CLI commands, but, IF you are using the Deployment Server to manage your Splunk Forwarders you could make one change via the web GUI for this blacklist and have it update globally to all Forwarders that have this inputs.conf stanza.

[maciep]

I guess it depends on your environment? Are you monitoring that file from a universal forwarder installed on the server? Or some other approach?

If you're using a uf, maybe just stop splunk on that box temporarily. Of if that's not option, maybe you can use one of these cli commands to remove/disable the monitor.

i don't see disabled listed there, but here's an older thread that makes it look possible

[somesoni2]

Have a look at this (look the comment under answer).
https://answers.splunk.com/answers/450900/can-i-disable-splunk-from-indexing-data-for-a-spec.html

[skulcak]

None of that addresses what i'm looking for. I want to dynamically issue a blockout from a script and the clear it once done. Editing a file is problrmatic in my thinking.