Getting Data In

From the CLI, can I issue a blackout on a specific monitoring target and then later clear the blackout?

skulcak
New Member

i am unfamiliar with Splunk terminology. i want to issue a blackout/stop monitoring an Oracle instance alert_log while is is being duplicated from a backup, using some kind of command line interface.

0 Karma

pdaigle_splunk
Splunk Employee
Splunk Employee

Another thought here is leveraging the whitelist and blacklist parameter of the file monitoring:

http://docs.splunk.com/Documentation/Splunk/6.5.0/Data/Whitelistorblacklistspecificincomingdata

In essence you could modify the inputs.conf add in the blacklist parameter that includes the alert_log file names. Any time those pop up, they would automatically be handled with not being indexed at all into Splunk.

If you still needed the alert_log file on a regular basis you can always comment out the blacklist line then remove the "#" when you need to invoke it.

No, you cannot do this via CLI commands, but, IF you are using the Deployment Server to manage your Splunk Forwarders you could make one change via the web GUI for this blacklist and have it update globally to all Forwarders that have this inputs.conf stanza.

maciep
Champion

I guess it depends on your environment? Are you monitoring that file from a universal forwarder installed on the server? Or some other approach?

If you're using a uf, maybe just stop splunk on that box temporarily. Of if that's not option, maybe you can use one of these cli commands to remove/disable the monitor.

i don't see disabled listed there, but here's an older thread that makes it look possible

0 Karma

somesoni2
SplunkTrust
SplunkTrust
0 Karma

skulcak
New Member

None of that addresses what i'm looking for. I want to dynamically issue a blockout from a script and the clear it once done. Editing a file is problrmatic in my thinking.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...