Getting Data In

How to blacklist a specific string from a log file

sunilpapaiah
New Member

Hi,

I have a log files under /export/logs/directory

/export/logs/vol-ext-test-ind-UPC-input.log

I tried below option to blacklist the files which has "UPC" string in the log file but no luck. can some one advice on it.

blacklist = Rf-UPC.log$|cg.log$
blacklist = UPC.log$|cg.log$
blacklist = /UPC.log$|cg.log$

Regards,
SP

0 Karma

DalJeanis
Legend

First thing - regex101.com is your friend. You can pop over there and check out whether your regular expression will match any particular incoming data.

In this case, if you want this file to be excluded...

 /export/logs/vol-ext-test-ind-UPC-input.log

...and if it's ANY log file with UPC somewhere in the file name, then you need a wildcard between UPC and .log to pick up all those letters in -input. That could be like this...

 blacklist = UPC.*\.log$

Now, a . matches EVERYTHING, so you will notice that I escaped it with a slash like this \., to tell the system that I meant to match only a period character, not anything else.

In general, I tend to be paranoid, so I'd also want to make sure that slashes between UPC and .log were NOT matched. This would only be relevant if the particular stanza had some directory wildcarding that could potentially come up with a directory that had UPC in the name. That would look something like this.

 blacklist = UPC[^\/]*\.log$

sunilpapaiah
New Member

above query did not save the actual entries. please find the correct one tested below.

blacklist = vol-UPC.log$|cg.log$
blacklist = UPC.log$|cg.log$
blacklist = /UPC.log$|cg.log$

0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...