Problem blacklisting single subdirectory

[benme]

I have universal forwarder 4.2.4 installed on a Windows 2008 server. I have it monitoring several directories, but I want to blacklist a single subdirectory, so all files in that subdirectory are ignored. I've tried the following in the inputs.conf file, but files in the subdirectory continue to be processed.

[monitor:///$WINDIR\MyDirectory]
blacklist = MySubDirectory

[monitor:///$WINDIR\MyDirectory]
blacklist = \MySubDirectory

[monitor:///$WINDIR\MyDirectory]
blacklist = \MySubDirectory\

[monitor:///$WINDIR\MyDirectory]
blacklist = \MySubDirectory\*

[monitor:///$WINDIR\MyDirectory]
blacklist = \\MySubDirectory

[monitor:///$WINDIR\MyDirectory]
blacklist = \\MySubDirectory\\

[monitor:///$WINDIR\MyDirectory]
blacklist = \\MySubDirectory\\*

[monitor:///$WINDIR\MyDirectory]
blacklist = /MySubDirectory

[monitor:///$WINDIR\MyDirectory]
blacklist = /MySubDirectory/

[monitor:///$WINDIR\MyDirectory]
blacklist = /MySubDirectory/*

and several other variations. I'm sure I'm missing something obvious. Thanks for the help.

[benme · Accepted solution]

I ended up uninstalling and reinstalling universal forwarder. After that blacklist worked properly.

[gkanapathy]

Since this is presumably on Windows/NTFS, try to make your blacklist case-insensitive:

blacklist = (?i)mysubdirectory

[_d_]

benme,

Are you sure you have not already indexed the directory prior to putting the blacklist in place? Splunk will keep the data in even if you later decide to blacklist the directory.

Hope this helps.

> please upvote and accept answer if you find it useful - thanks!

[_d_]

Did you try restarting the Universal Forwarder?