Splunk IT Service Intelligence

blocking specific input files

bhagyashrihegde
New Member

Hi Team,

We are using Splunk Enterprise on AWS environment. So long back there is an Cloudtrial app configured on the same. Logs are directly getting pushed to splunk indexer through S3 bucket based on the inputs configured on the Coudtrial app. Since this App version is old, there is no option to configure the inputs through GUI. we are making changes through inputs.conf file itself.

I've to block the Decrypt logs (.gz) getting indexed from the splunk. please suggest the work around for the same. Let us know if this cloud trial App has to be upgraded for the same and what will be the latest version of this.

Labels (1)
0 Karma

acfecondo75
Path Finder

Hello,

You can use blacklist within inputs.conf to exclude any files ending in .gz. For whichever input stanza is bringing in the AWS data, add:

blacklist=.gz$

More info on blacklist:

blacklist = regex

  • If set, files from this input are NOT monitored if their path matches the
    specified regex.
  • Takes precedence over the deprecated '_blacklist' setting, which functions the same way.
  • If a file matches the regexes in both the blacklist and whitelist settings,
    the file is NOT monitored. Blacklists take precedence over whitelists.
  • No default.

Hopefully that helps!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...