Stop Splunk To Read files

[Prakash493]

Hi , currently i need splunk to stop reading the log files from below source location , i updated disabled=true to stop splunk to read files but it still reading and added the blacklist stanza too but nothing works , splunk is still reading and indexing files , Please tell me how can i stop splunk to read the below entire source path ?

[monitor://C:\UCX\dotnet\UCXWinPortal\logs...\Pinnacle_AX_*.log]
disabled = true
recursive = false
index = xxxxx
sourcetype = xxxxx
blacklist = .(log)$

[wenthold]

Use btool to list out your current configuration. for whatever platform you're on go to the command line into the $SPLUNK_HOME folder and run:

bin/splunk btool inputs list 'monitor://C:\UCX\dotnet\UCXWinPortal\logs...\Pinnacle_AX_*.log' --debug

That command is for linux - for windows I believe it would be bin\splunk.exe btool ...

If you don't get any results, drop the configuration stanza and just run "splunk btool inputs list --debug | more" and find your configuration. It should tell you what Splunk sees as the combined configuration, and the configuration file source it's using for each item.

Use btool to troubleshoot configurations

[Prakash493]

it worked now actually i made a mistake on my blacklist regex syntax: i added blacklist = /.(log)$ , and it worked , Thanks

[493669]

Hi @Prakash493,
Try below in inputs.conf-

[monitor://C:\UCX\dotnet\UCXWinPortal\logs...\Pinnacle_AX_*.log]
disabled = 1

Also You can disable from UI
go to the Web UI -> Settings - Data Inputs -> Files and Directories -> Disable particular input

[Prakash493]

tried with it , didnt worked , i am in indexer cluster and search head cluster environment , where i can disable through deployment server ?

[493669]

Where are your stanza is written? is it indexer or heavy forwarder or universal forwarder?