Splunk Enterprise Security
Highlighted

Splunk inputs.conf - Read from all files in a directory except one file

New Member

Need to read from all files present in /temp/logs/ directory except one file abc.log

Directory looks like
xyz.log
ab.txt
ef.log
abc.log

inputs.conf
[monitor:///temp/logs/]
index = abc_xyz
sourcetype = server
disabled = false

0 Karma
Highlighted

Re: Splunk inputs.conf - Read from all files in a directory except one file

Legend

Hi òvishwanath119,
probably it's a visualization problem, try this inputs.conf

[monitor:///temp/logs/*]
index = abc_xyz
sourcetype = server
disabled = false

If you continue to have the problem, check if the unread file is a copy of another one, because by default Splunk doesn't read twice the same file even if with two different names.
If you want to read twice the same file with different names, you have to use the option crcSalt = <SOURCE> .

Ciao.
Giuseppe

0 Karma
Highlighted

Re: Splunk inputs.conf - Read from all files in a directory except one file

Motivator

Need to read from all files present in /temp/logs/ directory except one file abc.log

if your problem is that all files are being reading, but you want to exlclude abc.log then you need to add blacklist:

[monitor:///temp/logs/*]
index = abc_xyz
sourcetype = server
disabled = false
blacklist = */abc\.log

View solution in original post

0 Karma
Highlighted

Re: Splunk inputs.conf - Read from all files in a directory except one file

New Member

Why */ is used?

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.