Getting Data In

How to blacklist keywords in inputs.conf

alexspunkshell
Contributor

Hi,

I am using UF for syslog. In inputs.conf made index=cisco and sourcetype=syslog:ios and able to receive logs in console.

Now i am receiving too much logs. Having below keywords in logs.

"DOMAIN-2-IME"

"DOMAIN-2-IME_DETAILS"

"DOMAIN-5-TCA"

tried blacklist = "Domain" in inputs.conf but failed to filter it. Plese help me how to filter logs with Keywords in logs.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Blacklisting is for filenames to monitor, not keywords within events. To strip out events based on text within those events, check out SEDCMD in props.conf. It uses regular expressions to modify events before they're indexed. WARNING: your regex must identify the whole event if that is what you want to change. The UF will not do that for you.
You may want to check if your syslog server can do the filtering for you. That may be easier.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Developer Spotlight with William Searle

The Splunk Guy: A Developer’s Path from Web to Cloud William is a Splunk Professional Services Consultant with ...

Major Splunk Upgrade – Prepare your Environment for Splunk 10 Now!

Attention App Developers: Test Your Apps with the Splunk 10.0 Beta and Ensure Compatibility Before the ...

Stay Connected: Your Guide to June Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...