Monitoring Splunk

Disable monitoring of sub directories

Josh
Path Finder

Hello

How can I monitor the files within a directory but ignore its subdirectories?

e.g. I want to monitor all files in c:\mydir

However mydir contains a folder called temp how can I configure my inputs.conf file so that the files in the folder temp are not monitored.

I know I can use a blacklist for temp, however lets say mydir contains numorous other directories is there a way to just blacklist all directories within mydir?

Ta, Josh

1 Solution

gkanapathy
Splunk Employee
Splunk Employee

You can use the blacklist:

_blacklist = (?i)^c:\\mydir\\[^\\]+\\

View solution in original post

jrodman
Splunk Employee
Splunk Employee

You can also use a wildcard to only include immediate files within the directory.

[monitor://c:\mydir\*]

gkanapathy
Splunk Employee
Splunk Employee

You can use the blacklist:

_blacklist = (?i)^c:\\mydir\\[^\\]+\\
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Wednesday, May 29, 2024  |  11AM PST / 2PM ESTRegister now and join us to learn more about how you can ...

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer Certification at ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...