https://community.splunk.com/t5/Getting-Data-In/custom-Blacklist-not-working-correctly/m-p/79712#M16374 <P>In this topic in the docs:</P> <P><A href="http://docs.splunk.com/Documentation/Splunk/latest/Data/Whitelistorblacklistspecificincomingdata#Blacklist_.28ignore.29_files">http://docs.splunk.com/Documentation/Splunk/latest/Data/Whitelistorblacklistspecificincomingdata</A></P> <P>there's a note: "<STRONG>Important</STRONG>: If you create a blacklist line for each file you want to ignore, Splunk activates only the last filter."</P> <P>So it sounds like you need to combine your five lines into one in the [monitor:///usr/sap/IX4/DVEBMGS26/work] stanza.</P> Thu, 22 Sep 2011 09:14:18 GMT jlaw 2011-09-22T09:14:18Z https://community.splunk.com/t5/Getting-Data-In/custom-Blacklist-not-working-correctly/m-p/79711#M16373 <P>Trying to make a custom blacklist for one of my input monitor points that excludes certain directories and filetypes </P> <HR /> <P>[monitor:///usr/sap/IX4/DVEBMGS26/work]<BR /> disabled = false<BR /> blacklist = \VM*.<EM>$<BR /> blacklist = \vm</EM>.<EM>$<BR /> blacklist = (logs|jtmp)$<BR /> blacklist = *.(CPIC|old|trc|dump|DAT|CSV|sql)$<BR /> blacklist = \Y_</EM>.*$</P> <P>[monitor:///sapdb/data/wrk/IX4/knltrace]<BR /> disabled = false</P> <P>[monitor:///sapdb/data/wrk/IX4/dbm.prt]<BR /> disabled = false</P> <P>[monitor:///sapdb/data/wrk/IX4/KnlMsg]<BR /> disabled = false</P> <HR /> <P>But still files VM*.* and directory logs is not getting blacklisted. Can you please chck if syntax is correct?</P> <P>Thanks &amp; regards,<BR /> Kratika</P> Mon, 28 Sep 2020 09:53:47 GMT https://community.splunk.com/t5/Getting-Data-In/custom-Blacklist-not-working-correctly/m-p/79711#M16373 sushildabare 2020-09-28T09:53:47Z https://community.splunk.com/t5/Getting-Data-In/custom-Blacklist-not-working-correctly/m-p/79712#M16374 <P>In this topic in the docs:</P> <P><A href="http://docs.splunk.com/Documentation/Splunk/latest/Data/Whitelistorblacklistspecificincomingdata#Blacklist_.28ignore.29_files">http://docs.splunk.com/Documentation/Splunk/latest/Data/Whitelistorblacklistspecificincomingdata</A></P> <P>there's a note: "<STRONG>Important</STRONG>: If you create a blacklist line for each file you want to ignore, Splunk activates only the last filter."</P> <P>So it sounds like you need to combine your five lines into one in the [monitor:///usr/sap/IX4/DVEBMGS26/work] stanza.</P> Thu, 22 Sep 2011 09:14:18 GMT https://community.splunk.com/t5/Getting-Data-In/custom-Blacklist-not-working-correctly/m-p/79712#M16374 jlaw 2011-09-22T09:14:18Z