Getting Data In

How to make sure files containing a particular pair of letters are properly blacklisted?

nls7010
Path Finder

This is what I have started:

[monitor:///web/apps/doms/domains/*/CrewAdminAdapter.log]
index=wlsseappslogs
blacklist = *gc*\.log$
sourcetype = CrewAdminAdapter
crcSalt=

There are logs that look like: cw_nms_msa_ms011_gc060.log I don't want any of the logs that look like this but there are other logs very similar to this that I do want but they don't contain _gc which is our garbage collection file.

How do I keep those files from coming in with my blacklisting?

0 Karma

ddrillic
Ultra Champion

As we just spoke about in the other thread at Is it possible to use regular expressions and wildcard in the monitoring stanza of inputs.conf?

inputs.conf

Says -

alt text

The syntax is of wildcard and not regex. So, blacklist = *gc*.log should work and not blacklist = *gc*\.log$

You should be abe to validate it using ls *gc*.log.

0 Karma

adamsaul
Communicator

ddrillic,

The use of regular expressions within a blacklist is allowed.

The use of regular expressions within [monitor://....] is not allowed.

0 Karma

nls7010
Path Finder

sorry the line is gc.log$

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...