Hi, I’m trying to monitor changing log files within directories that change regularly. These log files are 7 layers deep on a Netapp share. I’m setting up the monitor stanza in inputs.conf on a Linux box. I have tried everything but only certain directories at the 3rd layer are being monitored, but not others at that same layer, including the one I need. I’ve added recursive = true and tried all variations of syntax with no luck. All permissions are the same as directories that can be monitored. What am I doing wrong? Thanks in advance. ... View more

Good Morning, I've followed guides/forums and steps on this site but still cant get my blacklists to work at all. The situation is that I've set up Splunk Alert Monitor dashboard and one of the alerts is new process starts, the splunk forwarder is causing hundreds of alerts on this so I want to blacklist it. Firstly could someone please confirm which inputs.conf to edit as there are multiple, secondly is this order correct?  [WinEventLog://Security] disabled=0 current_only=1 blacklist = 4689,5158  i.e. is the blacklist option in the right place? There are a few other lines on the inputs.conf I've found, like oldest first. Finally what string will actually work and stop me seeing all processes started by Splunk?   Thank you  in advance.  ... View more

Hi all, I have created a lookup table and imported it into SPLUNK. It has 2 columns, one called hosts the other called IPs. The columns are populated with the hosts I want to query. I'm very new to SPLUNK and would like to create a search that returns errors/events worth investigating from the hosts specified in the lookup file. I'll display the results on a dashboard and will be checking this daily for preventative maintenance on my system. I'm just after events worth looking in to and need to filter out irrelevant events to save time. Can anyone help? Thanks in advance. ... View more