Getting Data In

Splunk is ingesting archived data from our syslog servers. How do I stop this?

hrithiktej
Communicator

We have a syslog server with universal forwarder (UF) installed on it and my inputs.conf states /opt/splunk/syslogs/cisco/acs// and my logrotate.d has syslog-ng that states /opt/splunk/syslogs///*/syslog. Due to the logrotate daily cron job there are directories created with date text and .gz in the same directory and Splunk forwarder is reading them and resending it to indexers. How do i stop this?

0 Karma

hrithiktej
Communicator

after adding syslog to the end of my inputs stanza i.e. /opt/splunk/syslogs/cisco/acs/*/syslog it is now not reading the .gz files and only reads the directory syslog anything else that is there like date+syslog directory.gz it is not reading that i confirmed it from ./splunk list monitor command.

0 Karma

koshyk
Super Champion

hi,
do a blacklist on gz files in your inputs.conf

eg

[monitor:///var/log/xyz/]
disabled = false
ignoreOlderThan = 7d
recursive = true
index = my_index
blacklist = (\.tgz|\.gz)$
0 Karma

hrithiktej
Communicator

Thanks, I am using this now in my inputs.conf [monitor:///opt/splunk/syslogs/cisco/acs//syslog] instead of //* , lets c if this works if this does not then i will try your suggestion of blacklisting.

0 Karma

enicholson_splu
Splunk Employee
Splunk Employee

Modify your inputs.conf monitor the actual log files in that path. If the logs end in .log, wild card the .log extension. You can also blacklist the .gz files etc...

0 Karma
Get Updates on the Splunk Community!

Sending Metrics to Splunk Enterprise With the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

What's New in Splunk Cloud Platform 9.0.2208?!

Howdy!  We are happy to share the newest updates in Splunk Cloud Platform 9.0.2208! Analysts can benefit ...

Want a chance to win $500 to the Splunk shop? Take our IT Incident Management Survey!

  Top Trends & Best Practices in Incident ManagementSplunk is partnering up with Constellation Research to ...