Splunk Enterprise

Blacklist all files in windows folder and sub folders

perrinj2
Path Finder

I'm monitoring a Windows drive for any files ending in *.lrr and *.eve. This is because we have no control over where the files will be created. This may not be efficient but it works

I want to blacklist a folder on the drive and any sub folders so that the above files are not monitoring if they are in the blacklisted folder. The inputs.conf is

[monitor://D:\...\*.lrr]
disabled = false
whitelist =
index = au_cpe_common_app
sourcetype=LoadRunner_LRR
crcSalt = <SOURCE>
initCrcLength=1000


[monitor://D:\...\_t_rep.eve]
disabled = false
whitelist =
index = au_cpe_common_app
sourcetype=LoadRunner_EVE
crcSalt = <SOURCE>

[monitor://D:\DoNotMonitor\]
disabled = false
whitelist =
blacklist = .+
recursive = true

I would have expected the above blacklist to not monitor any files in the D:\DoNotMonitor folder recusively but it is ingesting files with source "D:\\DoNotMonitor\\donotmonitortest29042021\\_t_rep.eve"

What is the correct way to specify this? I can't find a well documented example of this specific use case

Labels (1)
Tags (1)
0 Karma
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...