Splunk Enterprise Security

Splunk inputs.conf - Read from all files in a directory except one file

New Member

Need to read from all files present in /temp/logs/ directory except one file abc.log

Directory looks like
xyz.log
ab.txt
ef.log
abc.log

inputs.conf
[monitor:///temp/logs/]
index = abc_xyz
sourcetype = server
disabled = false

0 Karma
1 Solution

Motivator

Need to read from all files present in /temp/logs/ directory except one file abc.log

if your problem is that all files are being reading, but you want to exlclude abc.log then you need to add blacklist:

[monitor:///temp/logs/*]
index = abc_xyz
sourcetype = server
disabled = false
blacklist = */abc\.log

View solution in original post

0 Karma

Motivator

Need to read from all files present in /temp/logs/ directory except one file abc.log

if your problem is that all files are being reading, but you want to exlclude abc.log then you need to add blacklist:

[monitor:///temp/logs/*]
index = abc_xyz
sourcetype = server
disabled = false
blacklist = */abc\.log

View solution in original post

0 Karma

New Member

Why */ is used?

0 Karma

Legend

Hi òvishwanath119,
probably it's a visualization problem, try this inputs.conf

[monitor:///temp/logs/*]
index = abc_xyz
sourcetype = server
disabled = false

If you continue to have the problem, check if the unread file is a copy of another one, because by default Splunk doesn't read twice the same file even if with two different names.
If you want to read twice the same file with different names, you have to use the option crcSalt = <SOURCE> .

Ciao.
Giuseppe

0 Karma