Getting Data In

How to exclude a specific file?

balcv
Contributor

I'm trying to exclude a specific file called catalina.out in /var/log/tomcat9/ from being processed by Splunk.  The file is being sent to my heavy forwarder and I have the following in inputs.conf 

[monitor:///var/log/tomcat9]
blacklist=(catalina\.out)
disabled = 0

The data continues to be processed.  What am I missing?

Labels (2)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Despite being a regular expression, there's no need to escape dots in blacklist or whitelist.  There's no need for a capture group, either.

[monitor:///var/log/tomcat9]
blacklist = catalina.out
disabled = 0

Don't forget to specify an index and sourcetype in the inputs.conf stanza.

---
If this reply helps you, Karma would be appreciated.

balcv
Contributor

Thanks @richgalloway .  I've removed the escape and added the index and source as suggested but that data is still appearing.

 [monitor:///var/log/tomcat9]
blacklist= catalina.out
index= main
source= catalina.out
disabled = 0

Can the order of the monitor statements have an impact?  For example could a preceding statement override this statement if the previous statement is for ///var/log but does not specifically reference tomcat9?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Stanza order may be significant.  Try swapping them.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Enhance Your Splunk App Development: New Tools & Support

UCC FrameworkAdd-on Builder has been around for quite some time. It helps build Splunk apps faster, but it ...

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...