Getting Data In

How do you blacklist within inputs.conf?

vinaykata
Path Finder

Hi all,

What's the exact way we can use blacklist in the inputs.conf file? Below is my example, and I am not sure if I should use regex or the path directly.

[monitor://C:\Program Files\Splunk*\etc...*.conf]
disabled = false
sourcetype = Conf
blacklist://C:\Program Files\Splunk*\etc...\app.conf

this stanza is to index all the Splunk config files. But I wanted to ignore the app.conf file under the same path. And also what's the correct format to use a second blacklist for another path?

Thank you all.

Tags (2)
0 Karma

ddrillic
Ultra Champion

The blacklist configuration actually points to a regular expression so the following should work -

blacklist = C:\\Program Files\\Splunk.*\\etc.*\\app\.conf

@DalJeanis spoke about it at Unable to blacklist multiple patterns using "|" in inputs.conf ?

It shows there how to use multiple regular expressions using the | sign.

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!