Getting Data In

How to filter out any directory starts out with "."

vincenty
Explorer

I am monitoring a series of directories. I want to blacklist any (sub)directories that is starting with a ".".

i.e.
/home/logs/dir1/dir2/.zfs/...
/home/logs/dir1/dir2/dir3/.snapshot/...

I can't seem to get a blacklist regex working for "any directory starting with a ."

[monitor:///home/logs/dir1/]
blacklist = \/.*

Tags (1)
0 Karma

kristian_kolb
Ultra Champion

/.* would match any character, 0 or more times. This would match all your files/dirs most likely.

Try /\.[^/]+/

Should mean 'slash, literal dot, not-slash (1 or more), slash'

/K

0 Karma

BobM
Builder

Blacklists and whitelists use perl compatible regular expressions (PCRE) so you need to change the blacklist. Replace . with \. and * with .*

try

blacklist = /\..*
0 Karma
Get Updates on the Splunk Community!

Splunk New Course Releases for a Changing World

Every day, the world feels like it’s moving faster with new technological breakthroughs, AI innovation, and ...

Insights from .conf 2025, Smart Edge Processor Scaling, and a New Splunk Lantern ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Machine Learning - Assisted Adaptive Thresholding

Let’s talk thresholding. Have you set up static thresholds? Tired of static thresholds triggering false ...