Getting Data In

blacklist not working

a212830
Champion

Hi,

I have an inputs.conf that is picking up a file that I want blacklisted. The file name is summary_1.diag. I thought this would filter it out. Any suggestions?

[monitor://F:\IBM\Lotus\Domino\Trace\*.diag]
sourcetype = STCommunityTraceLogs_diag
index = euc_sametimedata
disabled = false
followTail = 0
crcSalt = <SOURCE>
blacklist = summary_*.diag
Tags (1)
0 Karma

kristian_kolb
Ultra Champion

I think that your problem lies in the blacklist regex;

* is a quantifier which means 'match the preceding character zero or more times', and . (dot) means 'match any character' (including a literal dot). So summary_*.diag means summary followed by zero or more underscores, followed by a single character, followed by diag. This will match the following (and a lot of other strings);

summary.diag
summary_1diag
summary____Gdiag

However, it can not match summary_1.diag. A regex that matches summary_, followed by numbers, followed by .diag would look like;

summary_\d+\.diag

/K

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...