https://community.splunk.com/t5/Getting-Data-In/How-to-blacklist-inputs-conf-with-multiple-files-or-folders/m-p/600929#M104727 <P>Hello,</P><P>Below is the existing stanza in the inputs.conf</P><P>[monitor:///var/log]<BR />whitelist=(\.log|log$|messages|secure|auth|mesg$|cron$|acpid$|\.out)<BR />blacklist=(lastlog|anaconda\.syslog)<BR />disabled = 1</P><P>I also want to add the following folder to be blacklist</P><P>/var/log/dynatrace and any logs within the folder/sub folders.</P><P>Can you please explain how this can be done?</P><P>Is the syntax below correct?</P><P><SPAN>blacklist=(lastlog|anaconda\.syslog)|(dynatrace)</SPAN></P><P>Appreciate your experience and help.</P> Tue, 07 Jun 2022 18:47:45 GMT cxnsalvi 2022-06-07T18:47:45Z https://community.splunk.com/t5/Getting-Data-In/How-to-blacklist-inputs-conf-with-multiple-files-or-folders/m-p/600929#M104727 <P>Hello,</P><P>Below is the existing stanza in the inputs.conf</P><P>[monitor:///var/log]<BR />whitelist=(\.log|log$|messages|secure|auth|mesg$|cron$|acpid$|\.out)<BR />blacklist=(lastlog|anaconda\.syslog)<BR />disabled = 1</P><P>I also want to add the following folder to be blacklist</P><P>/var/log/dynatrace and any logs within the folder/sub folders.</P><P>Can you please explain how this can be done?</P><P>Is the syntax below correct?</P><P><SPAN>blacklist=(lastlog|anaconda\.syslog)|(dynatrace)</SPAN></P><P>Appreciate your experience and help.</P> Tue, 07 Jun 2022 18:47:45 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-blacklist-inputs-conf-with-multiple-files-or-folders/m-p/600929#M104727 cxnsalvi 2022-06-07T18:47:45Z