Getting Data In

Trying to properly format a blacklist for imported files.

New Member

I have configured multiple Data Inputs, pointing at folders such as /mnt/DataInput1 etc. There is a lot of noise so tried following the following links to add a blacklist to the inputs.conf for the input, to restrict junk data such as Level=INFO type linux data.

Example input:
disabled = false
index = customer_XXXX_XXXXXXXX
blacklist = Level="(INFO)"

Unfortunately after several tries, and after making a change, restarting Splunk to see the change, then waiting several hours for the Data Inputs page to queue up the number of files, it still doesn't work.

Can anyone please shed some insight into what I'm doing wrong please?
Ultimately I'd like to do something like:

blacklist = Level="(INFO)"|coderef="(salt*)|"consul)"

Where as you can see above, I want to blacklist =different event types.


Labels (1)
0 Karma


That's not what blacklisting does. The blacklist feature in a monitor statement tells Splunk to ignore any file that matches the given expression. It's often used to skip .gz files, for example.

Filtering certain events within a file is a different feature, which is implemented using transforms. See

If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...