Getting Data In

How to blacklist keywords in inputs.conf

alexspunkshell
Contributor

Hi,

I am using UF for syslog. In inputs.conf made index=cisco and sourcetype=syslog:ios and able to receive logs in console.

Now i am receiving too much logs. Having below keywords in logs.

"DOMAIN-2-IME"

"DOMAIN-2-IME_DETAILS"

"DOMAIN-5-TCA"

tried blacklist = "Domain" in inputs.conf but failed to filter it. Plese help me how to filter logs with Keywords in logs.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Blacklisting is for filenames to monitor, not keywords within events. To strip out events based on text within those events, check out SEDCMD in props.conf. It uses regular expressions to modify events before they're indexed. WARNING: your regex must identify the whole event if that is what you want to change. The UF will not do that for you.
You may want to check if your syslog server can do the filtering for you. That may be easier.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Now Playing: Splunk Education Summer Learning Premieres

It’s premiere season, and Splunk Education is rolling out new releases you won’t want to miss. Whether you’re ...

The Visibility Gap: Hybrid Networks and IT Services

The most forward thinking enterprises among us see their network as much more than infrastructure – it's their ...

Get Operational Insights Quickly with Natural Language on the Splunk Platform

In today’s fast-paced digital world, turning data into actionable insights is essential for success. With ...