Getting Data In

How to configure inputs.conf to monitor a directory with multiple folders, but ignore certain folders based on date in the path name?

seksit
Explorer

Hi

Now I'm working with many sub directories. I want to monitor some directories and don't want to monitor others.

This is example folder that I want to monitor and ignore some folder.

/home/user/2016-02-31/01/local3/
/home/user/2016-03-01/01/local3/
/home/user/2016-03-02/01/local7/
/home/user/2016-03-05/01/local3/

I want to monitor every folder dated in March and ignore folders dated in February.

I don't know how to configure inputs.conf. Now I'm using CLI (add monitor) for each folder.

[monitor:///home/user/......./*] << I don't know how to ignore folder on Feb.

Please kindly advise me.

Thank you

0 Karma
1 Solution

twinspop
Influencer

The inputs.conf blacklist feature should be serviceable for you:

[monitor:///home/user/......./*]
blacklist = /home/user/\d\d\d\d-02-\d\d/.*

View solution in original post

0 Karma

twinspop
Influencer

The inputs.conf blacklist feature should be serviceable for you:

[monitor:///home/user/......./*]
blacklist = /home/user/\d\d\d\d-02-\d\d/.*
0 Karma

seksit
Explorer

Thank you 🙂

0 Karma
Get Updates on the Splunk Community!

.conf25 Community Recap

Hello Splunkers, And just like that, .conf25 is in the books! What an incredible few days — full of learning, ...

Splunk App Developers | .conf25 Recap & What’s Next

If you stopped by the Builder Bar at .conf25 this year, thank you! The retro tech beer garden vibes were ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...