Splunk Search

Excluding a source

balcv
Contributor

I have a host sending log data and I am wanting to exclude a specific directory from being ingested and/or indexed but no matter what I try, the data continues to appear.

I am using a heavy forwarder that is acting as my config server for the agent and I have the indexer on another instance.

The source to be excluded is "/var/log/lsyncd/lsyncd-status.log" but I['m logging to exclude the "/var/log/lsyncd" directory

I have tried adding the following to $SPLUNK/apps/Splunk_TA_nix/local/inputs.conf on both the forwarder and indexer both but the data continues to flow:

monitor:///var/log/lsyncd
disabled = false

I have also tried adding a blacklist option using blacklist=(*.log) but again without the desired result.

What am I missing or how should I be configuring this?

0 Karma

manjunathmeti
Champion

Your monitor should be a stanza in inputs.conf on the forwarders.

 [monitor:///var/log/lsyncd]
 disabled = 1
0 Karma

balcv
Contributor

Thanks for that but this is exactly what I have in my inputs.conf yet the logs still keep coming through. Getting very frustrated.

0 Karma

manjunathmeti
Champion

Use btool to verify the attributes for this stanza. Check if it is actually disabled.

$SPLUNK_HOME/bin/splunk btool inputs list --debug
0 Karma

richgalloway
SplunkTrust
SplunkTrust

The monitor statement you tried enables an input, it does not disable one.
The blacklist may work, but the inputs.conf file must be installed on the agent rather than the forwarder or indexer.

---
If this reply helps you, Karma would be appreciated.
0 Karma

balcv
Contributor

I've changed to disabled=true and I have re-loaded the config out to the agents, but still receiving the data.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...