Getting Data In

From the CLI, can I issue a blackout on a specific monitoring target and then later clear the blackout?

skulcak
New Member

i am unfamiliar with Splunk terminology. i want to issue a blackout/stop monitoring an Oracle instance alert_log while is is being duplicated from a backup, using some kind of command line interface.

0 Karma

pdaigle_splunk
Splunk Employee
Splunk Employee

Another thought here is leveraging the whitelist and blacklist parameter of the file monitoring:

http://docs.splunk.com/Documentation/Splunk/6.5.0/Data/Whitelistorblacklistspecificincomingdata

In essence you could modify the inputs.conf add in the blacklist parameter that includes the alert_log file names. Any time those pop up, they would automatically be handled with not being indexed at all into Splunk.

If you still needed the alert_log file on a regular basis you can always comment out the blacklist line then remove the "#" when you need to invoke it.

No, you cannot do this via CLI commands, but, IF you are using the Deployment Server to manage your Splunk Forwarders you could make one change via the web GUI for this blacklist and have it update globally to all Forwarders that have this inputs.conf stanza.

maciep
Champion

I guess it depends on your environment? Are you monitoring that file from a universal forwarder installed on the server? Or some other approach?

If you're using a uf, maybe just stop splunk on that box temporarily. Of if that's not option, maybe you can use one of these cli commands to remove/disable the monitor.

i don't see disabled listed there, but here's an older thread that makes it look possible

0 Karma

somesoni2
Revered Legend
0 Karma

skulcak
New Member

None of that addresses what i'm looking for. I want to dynamically issue a blockout from a script and the clear it once done. Editing a file is problrmatic in my thinking.

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...