Getting Data In

How to add blacklist in inputs.conf file using Linux Command


Hi ,

We have a Splunk forwarder installed on a Linux platform. I have already added the monitor details in inputs.conf file. Now I want to avoid the files which have "test" in the name. So I need to add blacklist = test in inputs.conf file. Please let me know how to add it.

e;g ./splunk edit monitor

0 Karma


You can't. See here for all the options you can do via the CLI:

Adding a blacklist isn't one of them. You could probably do it with some regex/sed-magic. You could search for you particular monitoring stanza and add the blacklist line underneath it and then restart splunk. This should help:

0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!