Getting Data In

How to blacklist inputs.conf linux var log?

mikefg
Communicator

Having some trouble blacklisting a folder that has multiple dynamic subfolders and files. I want to blacklist everything for dir1 including files and any subfolders which are created dynamically. Splunk 8.x host is Linux.

I want to blacklist everything here   /var/log/dir1

Example paths

/var/log/dir1/file1.log
/var/log/dir1/dir2/otherfile.log

Currently trying this syntax, but it's not working. I do have another blacklist item that seems to be working and it is blacklist2 which is why I'm numbering the blacklists.

blacklist1 = .*dir1.*
blacklist2 = otheritem

Labels (3)
0 Karma
1 Solution

mikefg
Communicator

I got it to work. Here's what's working for me.

blacklist = dir1|dir2|\.log$

View solution in original post

0 Karma

mikefg
Communicator

I got it to work. Here's what's working for me.

blacklist = dir1|dir2|\.log$

0 Karma

SanjayReddy
SplunkTrust
SplunkTrust

 

Hi @mikefg 
can you try follow 

[blacklist:///var/log/dir1/.../*.log]

 OR 

[blacklist:///var/log/dir1/.../]

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...