Getting Data In

How to blacklist files with a wildcard in monitoring stanza?

Ashwini008
Builder

Hi,

I need to index  windows server logs and blacklist all the previous year logs.

Inputs.conf.

[monitor://E:\application\logs\server*]
disabled=0
sourcetype=_error_text
index=_error_file

Logs in the servers looks like below

Ashwini008_0-1673007673369.png

I refered solunk doc and came up with this stanza but it says only the last filter will be applied. Does it mean only 2019 blacklist regex will be applied?

[monitor://E:\application\logs\server*]
disabled=0
sourcetype=_error_text
index=_error_file
blacklist.1=^server-2021-\d{2}-\d{2}
blacklist.2=^server-2020-\d{2}-\d{2}
blacklist.3=^server-2019-\d{2}-\d{2}

Ashwini008_0-1673013043172.png

 

Please suggest.

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Monitor stanzas support a single blacklist setting.  That's why you get the message about only the last one being applied.  Contrast this with the blacklists for wineventlog stanzas.

Blacklists use regular expressions.  There is no concept in regex for "not this year" or "< 2023", etc.

I suggest using a whitelist for the current year, instead.  Something like this

whitelist = server-202[34]-\d\d-\d\d

will match files created this year and next (giving you time to update it at the end of 2023).

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Monitor stanzas support a single blacklist setting.  That's why you get the message about only the last one being applied.  Contrast this with the blacklists for wineventlog stanzas.

Blacklists use regular expressions.  There is no concept in regex for "not this year" or "< 2023", etc.

I suggest using a whitelist for the current year, instead.  Something like this

whitelist = server-202[34]-\d\d-\d\d

will match files created this year and next (giving you time to update it at the end of 2023).

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Strengthen Your Future: A Look Back at Splunk 10 Innovations and .conf25 Highlights!

The Big One: Splunk 10 is Here!  The moment many of you have been waiting for has arrived! We are thrilled to ...

Now Offering the AI Assistant Usage Dashboard in Cloud Monitoring Console

Today, we’re excited to announce the release of a brand new AI assistant usage dashboard in Cloud Monitoring ...

Stay Connected: Your Guide to October Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...