I have a host sending log data and I am wanting to exclude a specific directory from being ingested and/or indexed but no matter what I try, the data continues to appear.
I am using a heavy forwarder that is acting as my config server for the agent and I have the indexer on another instance.
The source to be excluded is "/var/log/lsyncd/lsyncd-status.log" but I['m logging to exclude the "/var/log/lsyncd" directory
I have tried adding the following to $SPLUNK/apps/Splunk_TA_nix/local/inputs.conf on both the forwarder and indexer both but the data continues to flow:
monitor:///var/log/lsyncd disabled = false
I have also tried adding a blacklist option using blacklist=(*.log) but again without the desired result.
What am I missing or how should I be configuring this?
The monitor statement you tried enables an input, it does not disable one.
The blacklist may work, but the inputs.conf file must be installed on the agent rather than the forwarder or indexer.