Getting Data In

question about _blacklist

abzmhzsplunk
New Member

Here is the section in my inputs.conf.
It deals with dynamically folder name, the ... could be the folder number name such as 334, the next build it will be 335, etc.
but I want to exclude other folders that fall into the ...
They are
C:\JENKINS\jobs\Smoke_Test\builds\lastUnsuccessfulBuild\log
C:\JENKINS\jobs\Smoke_Test\builds\lastsuccessfulBuild\log
C:\JENKINS\jobs\Smoke_Test\builds\lastStableBuild\log

I tried to modify the _blacklist but couldn't get it work.
Any help?

[monitor://C:\JENKINS\jobs\Smoke_Test\builds...\log]
disabled = false
sourcetype = gatling_log
_blacklist = .(gz)$
index=os
crcSalt =

0 Karma

niketn
Legend

_balcklist is a deprecated command, so try using blacklist instead. In fact if you are aware of all accpeted file type you should define the whitelist instead of blacklist.

In your example please try the following instead:

blacklist = \.txt$
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...

Updated Data Management and AWS GDI Inventory in Splunk Observability

We’re making some changes to Data Management and Infrastructure Inventory for AWS. The Data Management page, ...