Getting Data In

How do you blacklist within inputs.conf?

Path Finder

Hi all,

What's the exact way we can use blacklist in the inputs.conf file? Below is my example, and I am not sure if I should use regex or the path directly.

[monitor://C:\Program Files\Splunk*\etc...*.conf]
disabled = false
sourcetype = Conf
blacklist://C:\Program Files\Splunk*\etc...\app.conf

this stanza is to index all the Splunk config files. But I wanted to ignore the app.conf file under the same path. And also what's the correct format to use a second blacklist for another path?

Thank you all.

Tags (2)
0 Karma

Ultra Champion

The blacklist configuration actually points to a regular expression so the following should work -

blacklist = C:\\Program Files\\Splunk.*\\etc.*\\app\.conf

@DalJeanis spoke about it at Unable to blacklist multiple patterns using "|" in inputs.conf ?

It shows there how to use multiple regular expressions using the | sign.

0 Karma
Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...