Getting Data In

How to blacklist or whitelist logs monitored in a Windows directory?

shariinPH
Contributor

Hi

I have to monitor a specific folder in a certain directory
For example my path is
G:\opdata\my_data\motherfolder\
inside the motherfolder directory, there are sub directories which are

01 Jan 2015
02 Feb 2015
020115
030115
anotherfoldername
anotherfoldername2

I have to monitor the logs with the filenames **sunn.txt* on the directories with the format mmddyy which will match the directories 020115 and 030115

in my inputs.conf, i tried to put

[monitor://G:\opdata\my_data\motherfolder\*\*sunn.txt]
disabled = false
index = myindex
sourcetype = mysc
_TCP_ROUTING=devmay
crcSalt = <SOURCE>

but it doesnt forward anything on my indexer so i tried this one

[monitor://G:\opdata\my_data\motherfolder\...\*sunn.txt]
disabled = false
index = myindex
sourcetype = mysc
_TCP_ROUTING=devmay
crcSalt = <SOURCE>

but the problem here is all the files with sunn.txt were indexed, even files that has the *sunn.txt* in the 01 Jan 2015 and 02 Feb 2015 were indexed.

I'm thinking to use blacklist or whitelist, but I'm having trouble to use them.
Help me pls.

0 Karma

satishsdange
Builder

could you please try below

[monitor://G:\opdata\my_data\motherfolder\]
whitelist = \d+\*sunn.txt
0 Karma

satishsdange
Builder

If your query is still open, you may use below -

[monitor://G:\opdata\my_data\motherfolder\]
     whitelist = \d{6}\*sunn.txt
0 Karma

shariinPH
Contributor

It still doesnt work ..or does this configuration takes time before it takes effect?

0 Karma

satishsdange
Builder

did you restart UF?

0 Karma

shariinPH
Contributor

yes i've done it

0 Karma

shariinPH
Contributor

hi satishdange .. thanks, but it doesn't forward data to indexer .. what else do u think?

0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...