Getting Data In

How do I correct my forwarder blacklist configuration for FTP-Logs?

E_Andreas
New Member

Dear Community,

In our Webserver we have the following Logs: F:\IIS-Log
Sometimes we have F:\IIS-LOG\FTP and F:\IIS-LOG\WWW in this folder and sometimes the logs are stored on the Webserver without the FTP and WWW subfolders.

So we created following "inputs.conf" entry for our Windows-Webserver-APP (Deployment App):

[monitor://C:\inetpub\logs\LogFiles]
blacklist=*\FTP*$
index=winwebserver
sourcetype=iis
disabled=0

[monitor://F:\IIS-Log]
index=winwebserver
sourcetype=iis
blacklist=*\FTP*$
disabled=0

The Problem is, we still get the Logs from the F:\IIS-LOG\FTP\ Folder...
we need the * wildcard because sometimes the Logs are stored in F:\IIS-LOG\FTPSCV1\ folder etc.

How to correctly blacklist the FTP-Logs?

0 Karma

jaredlaney
Contributor

The blacklist actually needs to be a regular expression. Remember that "*" is a reserved character meaning zero or more. Could you try doing the following?

blacklist=FTP.*$ or maybe blacklist=FTP

Here are some more examples.
http://docs.splunk.com/Documentation/Splunk/6.2.0/Data/Whitelistorblacklistspecificincomingdata

You can test your regular expression at:

https://regex101.com/

0 Karma

E_Andreas
New Member

sorry i forgot the wildcard in the first post

blacklist=FTP*$
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...