Getting Data In

How Do I Blacklist a specific file.

englishjohn
New Member

I have a issue blacklisting a specific file "voipcall_wcas1.cdr.2016-10-12-17" the filename changes everyday as it follows the dates. It does not really have an extension. This part of the file name does not change "voipcall_wcas1.cdr."

Can somebody help me.

Thank you

0 Karma

inventsekar
Ultra Champion

Edit the inputs.conf for the app you're working in, (SPLUNK-HOME/etc/apps/search/local/inputs.conf would be the path for the default search app)

Now to ignore the voipcall_wcas1.cdr files, you simply add a blacklist to the same input.conf,

[monitor:///directory/directory2/]
disabled = false
index = main
_blacklist = voipcall_wcas1.cdr*

bpitts2
Path Finder

As long as you don't want ANY of the "voipcall_wcas1.cdr." files you could just add "voipcall_wcas1.cdr.*" to the blacklist.

Apparently, I cant submit this as an answer because I have less than 40 rep points.

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...