Getting Data In

How to filter out any directory starts out with "."

vincenty
Explorer

I am monitoring a series of directories. I want to blacklist any (sub)directories that is starting with a ".".

i.e.
/home/logs/dir1/dir2/.zfs/...
/home/logs/dir1/dir2/dir3/.snapshot/...

I can't seem to get a blacklist regex working for "any directory starting with a ."

[monitor:///home/logs/dir1/]
blacklist = \/.*

Tags (1)
0 Karma

kristian_kolb
Ultra Champion

/.* would match any character, 0 or more times. This would match all your files/dirs most likely.

Try /\.[^/]+/

Should mean 'slash, literal dot, not-slash (1 or more), slash'

/K

0 Karma

BobM
Builder

Blacklists and whitelists use perl compatible regular expressions (PCRE) so you need to change the blacklist. Replace . with \. and * with .*

try

blacklist = /\..*
0 Karma
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...