How to blacklist files in my data input where the filename has a .bin extension?

[andersonwes]

I have a directory with filenames like the ones below and want to blacklist the files in my data input where the filename has a .bin extension, but can't seem to. I think the multiple periods in the name is causing it to not filter. Any suggestions?

-rw-r--r-- 1 user1 usergrp   11291 Sep 22 14:22 wf_Generate_paramFiles.log
-rw-r--r-- 1 user1 usergrp   16015 Sep 22 14:22 wf_Generate_paramFiles.log.bin
-rw-r--r-- 1 user1 usergrp   10157 Mar 11  2014 wf_LU_APPLICATION.log.INSTANCE_COGNOS.27258.20140311135236
-rw-r--r-- 1 user1 usergrp   14648 Mar 11  2014 wf_LU_APPLICATION.log.INSTANCE_COGNOS.27258.20140311135236.bin
-rw-r--r-- 1 user1 usergrp   10216 Sep 22 13:22 wf_LU_APPLICATION.log.INSTANCE_COGNOS.395782.20140922132235
-rw-r--r-- 1 user1 usergrp   14653 Sep 22 13:22 wf_LU_APPLICATION.log.INSTANCE_COGNOS.395782.20140922132235.bin
-rw-r--r-- 1 user1 usergrp   8464 Sep 22 13:45 wf_MSTR_FT_TOOL_USER_DATA.log
-rw-r--r-- 1 user1 usergrp   12179 Sep 22 13:45 wf_MSTR_FT_TOOL_USER_DATA.log.bin
-rw-r--r-- 1 user1 usergrp   8223 Sep 22 13:45 wf_MSTR_FT_USER_DATA.log
-rw-r--r-- 1 user1 usergrp   11933 Sep 22 13:45 wf_MSTR_FT_USER_DATA.log.bin
-rw-r--r-- 1 user1 usergrp   8320 Sep 22 13:45 wf_MSTR_LU_APPLICATION.log
-rw-r--r-- 1 user1 usergrp   12032 Sep 22 13:45 wf_MSTR_LU_APPLICATION.log.bin
-rw-r--r-- 1 user1 usergrp   9670 Sep 22 14:22 wf_s_m_OpsRep_FETCH_ETL_WORKFLOWS.log
-rw-r--r-- 1 user1 usergrp   13927 Sep 22 14:22 wf_s_m_OpsRep_FETCH_ETL_WORKFLOWS.log.bin

[MuS]

Hi andersonwes,

a simple inputs.conf entry like this

blacklist = \.bin

should do the trick.

cheers, MuS

[andersonwes]

I still see all files including the .bin extenstions when using that suggestion.

[MuS]

did you restart splunk after the change?
is the config correctly applied, check with $SPLUNK_HOME/bin/splunk cmd btool inputs list?

[MuS]

btw already indexed file will still show up in a Splunk search, this will only apply to new files with extension .bin