Getting Data In

How to blacklist inputs.conf linux var log?

mikefg
Communicator

Having some trouble blacklisting a folder that has multiple dynamic subfolders and files. I want to blacklist everything for dir1 including files and any subfolders which are created dynamically. Splunk 8.x host is Linux.

I want to blacklist everything here   /var/log/dir1

Example paths

/var/log/dir1/file1.log
/var/log/dir1/dir2/otherfile.log

Currently trying this syntax, but it's not working. I do have another blacklist item that seems to be working and it is blacklist2 which is why I'm numbering the blacklists.

blacklist1 = .*dir1.*
blacklist2 = otheritem

Labels (3)
0 Karma
1 Solution

mikefg
Communicator

I got it to work. Here's what's working for me.

blacklist = dir1|dir2|\.log$

View solution in original post

0 Karma

mikefg
Communicator

I got it to work. Here's what's working for me.

blacklist = dir1|dir2|\.log$

0 Karma

SanjayReddy
SplunkTrust
SplunkTrust

 

Hi @mikefg 
can you try follow 

[blacklist:///var/log/dir1/.../*.log]

 OR 

[blacklist:///var/log/dir1/.../]

0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...