blocking specific input files

[bhagyashrihegde]

Hi Team,

We are using Splunk Enterprise on AWS environment. So long back there is an Cloudtrial app configured on the same. Logs are directly getting pushed to splunk indexer through S3 bucket based on the inputs configured on the Coudtrial app. Since this App version is old, there is no option to configure the inputs through GUI. we are making changes through inputs.conf file itself.

I've to block the Decrypt logs (.gz) getting indexed from the splunk. please suggest the work around for the same. Let us know if this cloud trial App has to be upgraded for the same and what will be the latest version of this.

[acfecondo75]

Hello,

You can use blacklist within inputs.conf to exclude any files ending in .gz. For whichever input stanza is bringing in the AWS data, add:

blacklist=.gz$

More info on blacklist:

blacklist = regex

• If set, files from this input are NOT monitored if their path matches the
  specified regex.
• Takes precedence over the deprecated '_blacklist' setting, which functions the same way.
• If a file matches the regexes in both the blacklist and whitelist settings,
  the file is NOT monitored. Blacklists take precedence over whitelists.
• No default.

Hopefully that helps!