Documentation: 3.0.1
|  Print Version Contents
This page last updated: 10/24/07 10:10am

File whitelisting / blacklisting

You can use inputs.conf to specify files to ignore (blacklist) or only consume (whitelist) for any specific source that you are tailing. The match for blacklist and whitelist uses regular expression syntax on the file name.

Please note: For whitelist and blacklist entries, please use exact regex syntax. The "..." wildcard is not supported. Whitelist and blacklist configurations must be in a configuration stanza, those outside a stanza are ignored (no global entries.)

Configuration

Blacklist (ignore) files

Add the following argument=value to your tail input stanza in $SPLUNK_HOME/etc/bundles/local/inputs.conf:

_blacklist = $YOUR_CUSTOM_REGEX

Whitelist (allow) files

Add the following argument=value to your tail input stanza in $SPLUNK_HOME/etc/bundles/local/inputs.conf

_whitelist = $YOUR_CUSTOM_REGEX

Example

[tail:///mnt/logs]
    _whitelist = .*\.log

This example tells Splunk to tail only files with the .log extension.

[tail:///mnt/logs]
    _blacklist = .*\.txt

This example tells Splunk to ignore all files with the .txt extension.

[tail:///mnt/logs]
    _blacklist = \.(txt|gz)$

This example tells Splunk to ignore all files with either .txt or .gz extension.

Verification tool

To verify that your whitelist and blacklist rules are configured properly you should run the listtails utility found in your $SPLUNK_HOME/bin directory. Without interacting with the server in any way, the utility reads in the configuration of inputs.conf in all bundles, scans your directories and shows you the exact list of files that Splunk will tail when you restart.

Note: The listtails utility requires you to first run the command source setSplunkEnv

Previous: This Page Has No H1 159454    |    Next: How host works

Comments

  1. This section could benefit from a few more examples. Perhaps how to filter out subdirectories, ignore case, etc.
    Posted by Dave on Nov 29 2007, 1:27pm

  2. _blacklist = .*\.(gz|csv)

    This example tells Splunk to ignore all files with the .gz or .csv extension.
    Posted by dmourati on Oct 11 2007, 4:38pm

Log in to comment.