unbounded joy or the musings of a sysadmin.
Wednesday, January 21, 2015
tell splunk to stop re-indexing stuff
splunk likes to re-index rotated log files on your local system. these re-index actions contribute to the data index limit of 500mb. curses. so, let's stop that since the data is already in the index.
[monitor:///var/log] blacklist = \.(gz|[0-9])$
and there you go.
Share to Twitter
Share to Facebook
Share to Pinterest
Post a Comment
Post Comments (Atom)