Getting Data In

How to exclude files from indexing using blacklist?

sergeyvinnik
Explorer

I need to blacklist files with specific letters inside the hostname like:

d:\logs\xxxxxxxxxMyLog__yyyyyyyy.txt

In this sample I want to ignore files with "MyLog__" combination inside the hostname.
What should I enter into Blacklist field in Web GUI?

Tags (1)
0 Karma

dshpritz
SplunkTrust
SplunkTrust

You would enter something like:

.*MyLog__.*

0 Karma

emechler_splunk
Splunk Employee
Splunk Employee

When you say hostname, do you really mean the full path name to the file?

0 Karma
Get Updates on the Splunk Community!

New Year, New Changes for Splunk Certifications

As we embrace a new year, we’re making a small but important update to the Splunk Certification ...

[Puzzles] Solve, Learn, Repeat: Unmerging HTML Tables

[Puzzles] Solve, Learn, Repeat: Unmerging HTML TablesFor a previous puzzle, I needed some sample data, and ...

Enterprise Security (ES) Essentials 8.3 is Now GA — Smarter Detections, Faster ...

As of today, Enterprise Security (ES) Essentials 8.3 is now generally available, helping SOC teams simplify ...