Getting Data In

Problem blacklisting single subdirectory

benme
Engager

I have universal forwarder 4.2.4 installed on a Windows 2008 server. I have it monitoring several directories, but I want to blacklist a single subdirectory, so all files in that subdirectory are ignored. I've tried the following in the inputs.conf file, but files in the subdirectory continue to be processed.

[monitor:///$WINDIR\MyDirectory]
blacklist = MySubDirectory

[monitor:///$WINDIR\MyDirectory]
blacklist = \MySubDirectory

[monitor:///$WINDIR\MyDirectory]
blacklist = \MySubDirectory\

[monitor:///$WINDIR\MyDirectory]
blacklist = \MySubDirectory\*

[monitor:///$WINDIR\MyDirectory]
blacklist = \\MySubDirectory

[monitor:///$WINDIR\MyDirectory]
blacklist = \\MySubDirectory\\

[monitor:///$WINDIR\MyDirectory]
blacklist = \\MySubDirectory\\*

[monitor:///$WINDIR\MyDirectory]
blacklist = /MySubDirectory

[monitor:///$WINDIR\MyDirectory]
blacklist = /MySubDirectory/

[monitor:///$WINDIR\MyDirectory]
blacklist = /MySubDirectory/*

and several other variations. I'm sure I'm missing something obvious. Thanks for the help.

0 Karma
1 Solution

benme
Engager

I ended up uninstalling and reinstalling universal forwarder. After that blacklist worked properly.

View solution in original post

0 Karma

benme
Engager

I ended up uninstalling and reinstalling universal forwarder. After that blacklist worked properly.

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

Since this is presumably on Windows/NTFS, try to make your blacklist case-insensitive:

blacklist = (?i)mysubdirectory

_d_
Splunk Employee
Splunk Employee

benme,

Are you sure you have not already indexed the directory prior to putting the blacklist in place? Splunk will keep the data in even if you later decide to blacklist the directory.

Hope this helps.

> please upvote and accept answer if you find it useful - thanks!

0 Karma

_d_
Splunk Employee
Splunk Employee

Did you try restarting the Universal Forwarder?

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...