Getting Data In

forwarder, syslog & blacklist

tinkster
Explorer

I installed the splunkforwarder on a few machines, and added /var/log as a syslog source. I overlooked the fact that there's freeradius accounting data in one of the subdirectories that I really don't want in splunk.

How do I get rid of it?

How do I tell the forwarder to ignore the subdirectory /var/log/freeradius/radacct and its subdirectories?

Tags (2)
0 Karma

MuS
SplunkTrust
SplunkTrust

Hi tinkster,

use a blacklist in your monitor stanza in inputs.conf like this

blacklist = /var/log/freeradius/radacct

If blacklist is set and the files path matches the specified regex from this input, they are NOT monitored.

hope this helps ...

cheers, MuS

0 Karma

MuS
SplunkTrust
SplunkTrust

btw the entry in blacklist is a regex and will be treated as such. In your case it tries to match /var/log/freeradius/radacct/.* if you still encounter problems remove the .* at the end

0 Karma

MuS
SplunkTrust
SplunkTrust

Yes, delete will no delete event from the index - they are only marked as 'unsearchable'.
clean will remove all events from a given index.
You can find your options in this http://docs.splunk.com/Documentation/Splunk/6.1/Indexer/RemovedatafromSplunk doc

0 Karma

tinkster
Explorer

Thanks for this part of the answer - this is what I did; specifically, blacklist = /var/log/freeradius/radacct/.*.

Now - how do I get the accidentally indexed data deleted? The search | delete seems to stop the data from showing up in searches, but the diskspace didn't get reclaimed.

I don't quite understand whether "clean" will only cull unwanted index entries, or ALL index entries.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...