Getting Data In

How to blacklist a specific string from a log file

sunilpapaiah
New Member

Hi,

I have a log files under /export/logs/directory

/export/logs/vol-ext-test-ind-UPC-input.log

I tried below option to blacklist the files which has "UPC" string in the log file but no luck. can some one advice on it.

blacklist = Rf-UPC.log$|cg.log$
blacklist = UPC.log$|cg.log$
blacklist = /UPC.log$|cg.log$

Regards,
SP

0 Karma

DalJeanis
Legend

First thing - regex101.com is your friend. You can pop over there and check out whether your regular expression will match any particular incoming data.

In this case, if you want this file to be excluded...

 /export/logs/vol-ext-test-ind-UPC-input.log

...and if it's ANY log file with UPC somewhere in the file name, then you need a wildcard between UPC and .log to pick up all those letters in -input. That could be like this...

 blacklist = UPC.*\.log$

Now, a . matches EVERYTHING, so you will notice that I escaped it with a slash like this \., to tell the system that I meant to match only a period character, not anything else.

In general, I tend to be paranoid, so I'd also want to make sure that slashes between UPC and .log were NOT matched. This would only be relevant if the particular stanza had some directory wildcarding that could potentially come up with a directory that had UPC in the name. That would look something like this.

 blacklist = UPC[^\/]*\.log$

sunilpapaiah
New Member

above query did not save the actual entries. please find the correct one tested below.

blacklist = vol-UPC.log$|cg.log$
blacklist = UPC.log$|cg.log$
blacklist = /UPC.log$|cg.log$

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...