Getting Data In

How Do I Blacklist a specific file.

englishjohn
New Member

I have a issue blacklisting a specific file "voipcall_wcas1.cdr.2016-10-12-17" the filename changes everyday as it follows the dates. It does not really have an extension. This part of the file name does not change "voipcall_wcas1.cdr."

Can somebody help me.

Thank you

0 Karma

inventsekar
SplunkTrust
SplunkTrust

Edit the inputs.conf for the app you're working in, (SPLUNK-HOME/etc/apps/search/local/inputs.conf would be the path for the default search app)

Now to ignore the voipcall_wcas1.cdr files, you simply add a blacklist to the same input.conf,

[monitor:///directory/directory2/]
disabled = false
index = main
_blacklist = voipcall_wcas1.cdr*
thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !

bpitts2
Path Finder

As long as you don't want ANY of the "voipcall_wcas1.cdr." files you could just add "voipcall_wcas1.cdr.*" to the blacklist.

Apparently, I cant submit this as an answer because I have less than 40 rep points.

Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...