Getting Data In

How to blacklist a specific string from a log file

sunilpapaiah
New Member

Hi,

I have a log files under /export/logs/directory

/export/logs/vol-ext-test-ind-UPC-input.log

I tried below option to blacklist the files which has "UPC" string in the log file but no luck. can some one advice on it.

blacklist = Rf-UPC.log$|cg.log$
blacklist = UPC.log$|cg.log$
blacklist = /UPC.log$|cg.log$

Regards,
SP

0 Karma

DalJeanis
SplunkTrust
SplunkTrust

First thing - regex101.com is your friend. You can pop over there and check out whether your regular expression will match any particular incoming data.

In this case, if you want this file to be excluded...

 /export/logs/vol-ext-test-ind-UPC-input.log

...and if it's ANY log file with UPC somewhere in the file name, then you need a wildcard between UPC and .log to pick up all those letters in -input. That could be like this...

 blacklist = UPC.*\.log$

Now, a . matches EVERYTHING, so you will notice that I escaped it with a slash like this \., to tell the system that I meant to match only a period character, not anything else.

In general, I tend to be paranoid, so I'd also want to make sure that slashes between UPC and .log were NOT matched. This would only be relevant if the particular stanza had some directory wildcarding that could potentially come up with a directory that had UPC in the name. That would look something like this.

 blacklist = UPC[^\/]*\.log$

sunilpapaiah
New Member

above query did not save the actual entries. please find the correct one tested below.

blacklist = vol-UPC.log$|cg.log$
blacklist = UPC.log$|cg.log$
blacklist = /UPC.log$|cg.log$

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...