Getting Data In

need help setting up a blacklist


Hi guys,

Trying to make a custom blacklist for one of my input monitor points that excludes certain directories and filetypes (gz).

This is when I have so far:



host = myhost


disabled = false

blacklist = (subfolder1|subfolder2|subfolder3|subfolder4|\.gz$|\.\d+$)

index = my_index

sourcetype = my_source_type

Can someone confirm if this is the correct way to do this?



Tags (2)
0 Karma

Re: need help setting up a blacklist


yes, the above will work. However, it's probably unnecessary to specify the host as it will be inherited or derived from the local machine name, unless you need it to be different. If you do, it may make sense to specify it under the [monitor] stanza rather than [default], but really it depends on the rest of your usage.

Note that your blacklist might be too broad, e.g., if one of your subfolders is called "bin", then you will also exclude any file named "binary.log" as well as everything in a directory named "bingo". You'd need to make your regex more specific if you want to avoid that happening.

View solution in original post

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.