Getting Data In

How to blacklist a specific string from a log file

sunilpapaiah
New Member

Hi,

I have a log files under /export/logs/directory

/export/logs/vol-ext-test-ind-UPC-input.log

I tried below option to blacklist the files which has "UPC" string in the log file but no luck. can some one advice on it.

blacklist = Rf-UPC.log$|cg.log$
blacklist = UPC.log$|cg.log$
blacklist = /UPC.log$|cg.log$

Regards,
SP

0 Karma

DalJeanis
Legend

First thing - regex101.com is your friend. You can pop over there and check out whether your regular expression will match any particular incoming data.

In this case, if you want this file to be excluded...

 /export/logs/vol-ext-test-ind-UPC-input.log

...and if it's ANY log file with UPC somewhere in the file name, then you need a wildcard between UPC and .log to pick up all those letters in -input. That could be like this...

 blacklist = UPC.*\.log$

Now, a . matches EVERYTHING, so you will notice that I escaped it with a slash like this \., to tell the system that I meant to match only a period character, not anything else.

In general, I tend to be paranoid, so I'd also want to make sure that slashes between UPC and .log were NOT matched. This would only be relevant if the particular stanza had some directory wildcarding that could potentially come up with a directory that had UPC in the name. That would look something like this.

 blacklist = UPC[^\/]*\.log$

sunilpapaiah
New Member

above query did not save the actual entries. please find the correct one tested below.

blacklist = vol-UPC.log$|cg.log$
blacklist = UPC.log$|cg.log$
blacklist = /UPC.log$|cg.log$

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Can’t Make It to Boston? Stream .conf25 and Learn with Haya Husain

Boston may be buzzing this September with Splunk University and .conf25, but you don’t have to pack a bag to ...

Splunk Lantern’s Guide to The Most Popular .conf25 Sessions

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Unlock What’s Next: The Splunk Cloud Platform at .conf25

In just a few days, Boston will be buzzing as the Splunk team and thousands of community members come together ...