topic How to acknowledge the blacklist working or not ?? in Deployment Architecture https://community.splunk.com/t5/Deployment-Architecture/How-to-acknowledge-the-blacklist-working-or-not/m-p/658778#M27493 <P>Hi Everyone,</P><P><SPAN>I've recently applied a blacklist file path regex to one of the apps inputs.conf in the serverclass on the host in DS. How can I determine&nbsp; it's working or not?</SPAN></P> Tue, 26 Sep 2023 17:03:51 GMT AL3Z 2023-09-26T17:03:51Z How to acknowledge the blacklist working or not ?? https://community.splunk.com/t5/Deployment-Architecture/How-to-acknowledge-the-blacklist-working-or-not/m-p/658778#M27493 <P>Hi Everyone,</P><P><SPAN>I've recently applied a blacklist file path regex to one of the apps inputs.conf in the serverclass on the host in DS. How can I determine&nbsp; it's working or not?</SPAN></P> Tue, 26 Sep 2023 17:03:51 GMT https://community.splunk.com/t5/Deployment-Architecture/How-to-acknowledge-the-blacklist-working-or-not/m-p/658778#M27493 AL3Z 2023-09-26T17:03:51Z Re: How to acknowledge the blacklist working or not ?? https://community.splunk.com/t5/Deployment-Architecture/How-to-acknowledge-the-blacklist-working-or-not/m-p/658779#M27494 <P>If you no longer see data from the blocked data source then the denylist is working.</P> Tue, 26 Sep 2023 17:21:13 GMT https://community.splunk.com/t5/Deployment-Architecture/How-to-acknowledge-the-blacklist-working-or-not/m-p/658779#M27494 richgalloway 2023-09-26T17:21:13Z Re: How to acknowledge the blacklist working or not ?? https://community.splunk.com/t5/Deployment-Architecture/How-to-acknowledge-the-blacklist-working-or-not/m-p/658780#M27495 <P>Can you pls share the spl command.</P> Tue, 26 Sep 2023 17:35:42 GMT https://community.splunk.com/t5/Deployment-Architecture/How-to-acknowledge-the-blacklist-working-or-not/m-p/658780#M27495 AL3Z 2023-09-26T17:35:42Z Re: How to acknowledge the blacklist working or not ?? https://community.splunk.com/t5/Deployment-Architecture/How-to-acknowledge-the-blacklist-working-or-not/m-p/658784#M27496 <P>You just search for events which have your file(s) as source field value. If they stopped being ingested at some point your blacklisting works. Unless of course you have some additional config overwriting the source field but then it's up to you to find those events - we don't know your setup.</P> Wed, 27 Sep 2023 07:24:07 GMT https://community.splunk.com/t5/Deployment-Architecture/How-to-acknowledge-the-blacklist-working-or-not/m-p/658784#M27496 PickleRick 2023-09-27T07:24:07Z