Getting Data In

How to blacklist a specific string from a log file

sunilpapaiah
New Member

Hi,

I have a log files under /export/logs/directory

/export/logs/vol-ext-test-ind-UPC-input.log

I tried below option to blacklist the files which has "UPC" string in the log file but no luck. can some one advice on it.

blacklist = Rf-UPC.log$|cg.log$
blacklist = UPC.log$|cg.log$
blacklist = /UPC.log$|cg.log$

Regards,
SP

0 Karma

DalJeanis
Legend

First thing - regex101.com is your friend. You can pop over there and check out whether your regular expression will match any particular incoming data.

In this case, if you want this file to be excluded...

 /export/logs/vol-ext-test-ind-UPC-input.log

...and if it's ANY log file with UPC somewhere in the file name, then you need a wildcard between UPC and .log to pick up all those letters in -input. That could be like this...

 blacklist = UPC.*\.log$

Now, a . matches EVERYTHING, so you will notice that I escaped it with a slash like this \., to tell the system that I meant to match only a period character, not anything else.

In general, I tend to be paranoid, so I'd also want to make sure that slashes between UPC and .log were NOT matched. This would only be relevant if the particular stanza had some directory wildcarding that could potentially come up with a directory that had UPC in the name. That would look something like this.

 blacklist = UPC[^\/]*\.log$

sunilpapaiah
New Member

above query did not save the actual entries. please find the correct one tested below.

blacklist = vol-UPC.log$|cg.log$
blacklist = UPC.log$|cg.log$
blacklist = /UPC.log$|cg.log$

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Classic British Rock Bands

This puzzle series (first published here) is based on extracting information from statements about well-known ...

New to the Community? Join Us for an Exclusive Post .conf26 Welcome Session (Plus a ...

Keep the .conf26 Energy Going: Welcome to the Splunk Community! Whether we scanned your badge at the Community ...

Accelerate Splunk App Development with AI

  Learn how to automate the repetitive parts of your build cycle.   Register to Attend   Join our Tech Talk ...