Getting Data In

How to blacklist inputs.conf with multiple files or folders?

cxnsalvi
Engager

Hello,

Below is the existing stanza in the inputs.conf

[monitor:///var/log]
whitelist=(\.log|log$|messages|secure|auth|mesg$|cron$|acpid$|\.out)
blacklist=(lastlog|anaconda\.syslog)
disabled = 1

I also want to add the following folder to be blacklist

/var/log/dynatrace and any logs within the folder/sub folders.

Can you please explain how this can be done?

Is the syntax below correct?

blacklist=(lastlog|anaconda\.syslog)|(dynatrace)

Appreciate your experience and help.

Labels (2)
0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...