Excluding a source

[balcv]

I have a host sending log data and I am wanting to exclude a specific directory from being ingested and/or indexed but no matter what I try, the data continues to appear.

I am using a heavy forwarder that is acting as my config server for the agent and I have the indexer on another instance.

The source to be excluded is "/var/log/lsyncd/lsyncd-status.log" but I['m logging to exclude the "/var/log/lsyncd" directory

I have tried adding the following to $SPLUNK/apps/Splunk_TA_nix/local/inputs.conf on both the forwarder and indexer both but the data continues to flow:

monitor:///var/log/lsyncd
disabled = false

I have also tried adding a blacklist option using blacklist=(*.log) but again without the desired result.

What am I missing or how should I be configuring this?

[manjunathmeti]

Your monitor should be a stanza in inputs.conf on the forwarders.

 [monitor:///var/log/lsyncd]
 disabled = 1

[balcv]

Thanks for that but this is exactly what I have in my inputs.conf yet the logs still keep coming through. Getting very frustrated.

[manjunathmeti]

Use btool to verify the attributes for this stanza. Check if it is actually disabled.

$SPLUNK_HOME/bin/splunk btool inputs list --debug

[richgalloway]

The monitor statement you tried enables an input, it does not disable one.
The blacklist may work, but the inputs.conf file must be installed on the agent rather than the forwarder or indexer.

[balcv]

I've changed to disabled=true and I have re-loaded the config out to the agents, but still receiving the data.