Getting Data In

blacklist not working

a212830
Champion

Hi,

I have an inputs.conf that is picking up a file that I want blacklisted. The file name is summary_1.diag. I thought this would filter it out. Any suggestions?

[monitor://F:\IBM\Lotus\Domino\Trace\*.diag]
sourcetype = STCommunityTraceLogs_diag
index = euc_sametimedata
disabled = false
followTail = 0
crcSalt = <SOURCE>
blacklist = summary_*.diag
Tags (1)
0 Karma

kristian_kolb
Ultra Champion

I think that your problem lies in the blacklist regex;

* is a quantifier which means 'match the preceding character zero or more times', and . (dot) means 'match any character' (including a literal dot). So summary_*.diag means summary followed by zero or more underscores, followed by a single character, followed by diag. This will match the following (and a lot of other strings);

summary.diag
summary_1diag
summary____Gdiag

However, it can not match summary_1.diag. A regex that matches summary_, followed by numbers, followed by .diag would look like;

summary_\d+\.diag

/K

Get Updates on the Splunk Community!

Demo Day: Strengthen Your SOC with Splunk Enterprise Security 8.1

Today’s threat landscape is more complex than ever. Security operation centers (SOCs) are overwhelmed with ...

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...