Getting Data In

How to blacklist inputs.conf linux var log?

mikefg
Communicator

Having some trouble blacklisting a folder that has multiple dynamic subfolders and files. I want to blacklist everything for dir1 including files and any subfolders which are created dynamically. Splunk 8.x host is Linux.

I want to blacklist everything here   /var/log/dir1

Example paths

/var/log/dir1/file1.log
/var/log/dir1/dir2/otherfile.log

Currently trying this syntax, but it's not working. I do have another blacklist item that seems to be working and it is blacklist2 which is why I'm numbering the blacklists.

blacklist1 = .*dir1.*
blacklist2 = otheritem

Labels (3)
0 Karma
1 Solution

mikefg
Communicator

I got it to work. Here's what's working for me.

blacklist = dir1|dir2|\.log$

View solution in original post

0 Karma

mikefg
Communicator

I got it to work. Here's what's working for me.

blacklist = dir1|dir2|\.log$

0 Karma

SanjayReddy
SplunkTrust
SplunkTrust

 

Hi @mikefg 
can you try follow 

[blacklist:///var/log/dir1/.../*.log]

 OR 

[blacklist:///var/log/dir1/.../]

0 Karma
Get Updates on the Splunk Community!

SplunkTrust Application Period is Officially OPEN!

It's that time, folks! The application/nomination period for the 2025 SplunkTrust is officially open! If you ...

Splunk Answers Content Calendar, June Edition II

Get ready to dive into Splunk Dashboard panels this week! We'll be tackling common questions around ...

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...