Splunk Search

blacklist matching issues

lrhazi
Path Finder

The documentation says:

If you want Splunk to ignore entire directories beneath a monitor input refer to this example:

[monitor:///mnt/logs]
    blacklist = (archive|historical|\.bak$)
The above example tells Splunk to ignore all files under /mnt/logs/ within the archive directory, within historical directory and to ignore all files ending in *.bak.

The above would also exclude a folder named archives for example, right?
In my tests, I was trying to exclude sa from /var/log and it seemed to have also excluded /var/log/messages

How do I exclude folders: sa and puppet from monitoring /var/log

How does the matching actually work? matches the whole path of the files, include /mnt/logs, in the above example?

Tags (2)
0 Karma

woodcock
Esteemed Legend

Like this:

blacklist = (/|\\)puppet|sa(/|\\)

Both front- and back- slashes are important to cover *nix and windows and they have to be on both ends or you will match things like .../sockpuppet/...,

0 Karma

lrhazi
Path Finder

Looks like adding a slash like so works:

blacklist = (puppet/|sa/)

though that is still not exactly: Exclude any folders named puppet or sa

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...