Getting Data In

How to blacklist files in my data input where the filename has a .bin extension?

andersonwes
New Member

I have a directory with filenames like the ones below and want to blacklist the files in my data input where the filename has a .bin extension, but can't seem to. I think the multiple periods in the name is causing it to not filter. Any suggestions?

-rw-r--r-- 1 user1 usergrp   11291 Sep 22 14:22 wf_Generate_paramFiles.log
-rw-r--r-- 1 user1 usergrp   16015 Sep 22 14:22 wf_Generate_paramFiles.log.bin
-rw-r--r-- 1 user1 usergrp   10157 Mar 11  2014 wf_LU_APPLICATION.log.INSTANCE_COGNOS.27258.20140311135236
-rw-r--r-- 1 user1 usergrp   14648 Mar 11  2014 wf_LU_APPLICATION.log.INSTANCE_COGNOS.27258.20140311135236.bin
-rw-r--r-- 1 user1 usergrp   10216 Sep 22 13:22 wf_LU_APPLICATION.log.INSTANCE_COGNOS.395782.20140922132235
-rw-r--r-- 1 user1 usergrp   14653 Sep 22 13:22 wf_LU_APPLICATION.log.INSTANCE_COGNOS.395782.20140922132235.bin
-rw-r--r-- 1 user1 usergrp   8464 Sep 22 13:45 wf_MSTR_FT_TOOL_USER_DATA.log
-rw-r--r-- 1 user1 usergrp   12179 Sep 22 13:45 wf_MSTR_FT_TOOL_USER_DATA.log.bin
-rw-r--r-- 1 user1 usergrp   8223 Sep 22 13:45 wf_MSTR_FT_USER_DATA.log
-rw-r--r-- 1 user1 usergrp   11933 Sep 22 13:45 wf_MSTR_FT_USER_DATA.log.bin
-rw-r--r-- 1 user1 usergrp   8320 Sep 22 13:45 wf_MSTR_LU_APPLICATION.log
-rw-r--r-- 1 user1 usergrp   12032 Sep 22 13:45 wf_MSTR_LU_APPLICATION.log.bin
-rw-r--r-- 1 user1 usergrp   9670 Sep 22 14:22 wf_s_m_OpsRep_FETCH_ETL_WORKFLOWS.log
-rw-r--r-- 1 user1 usergrp   13927 Sep 22 14:22 wf_s_m_OpsRep_FETCH_ETL_WORKFLOWS.log.bin
Tags (1)
0 Karma

MuS
Legend

Hi andersonwes,

a simple inputs.conf entry like this

blacklist = \.bin

should do the trick.

cheers, MuS

andersonwes
New Member

I still see all files including the .bin extenstions when using that suggestion.

0 Karma

MuS
Legend

did you restart splunk after the change?
is the config correctly applied, check with $SPLUNK_HOME/bin/splunk cmd btool inputs list?

0 Karma

MuS
Legend

btw already indexed file will still show up in a Splunk search, this will only apply to new files with extension .bin

0 Karma
Get Updates on the Splunk Community!

Say goodbye to manually analyzing phishing and malware threats with Splunk Attack ...

In today’s evolving threat landscape, we understand you’re constantly bombarded with phishing and malware ...

AppDynamics is now part of Splunk Ideas

Hello Splunkers, We have exciting news for you! AppDynamics has been added to the Splunk Ideas Portal. Which ...

Advanced Splunk Data Management Strategies

Join us on Wednesday, May 14, 2025, at 11 AM PDT / 2 PM EDT for an exclusive Tech Talk that delves into ...