topic Re: How to blacklist specific hosts so Splunk will not index their IIS logs in our &quot;iis&quot; index? in Getting Data In https://community.splunk.com/t5/Getting-Data-In/How-to-blacklist-specific-hosts-so-Splunk-will-not-index-their/m-p/212551#M41791 <P>a blacklist is a regex, so you may want to do :</P> <PRE><CODE>blacklist = (Server1|Server2) </CODE></PRE> <P>beware this is also case sensitive.</P> Wed, 02 Sep 2015 21:36:50 GMT yannK 2015-09-02T21:36:50Z How to blacklist specific hosts so Splunk will not index their IIS logs in our "iis" index? https://community.splunk.com/t5/Getting-Data-In/How-to-blacklist-specific-hosts-so-Splunk-will-not-index-their/m-p/212550#M41790 <P>I have an index called "iis".</P> <P>How can I blacklist some specific hosts so that Splunk would not process iis logs for these hosts?<BR /> I did something like this in inputs.conf, but this is not working:</P> <PRE><CODE># IIS Logs [monitor://S:\logs\W3SVC*\*.log] sourcetype = iis index = iis ignoreOlderThan = 30d disabled = false blacklist = Server1,server2 </CODE></PRE> Wed, 02 Sep 2015 19:08:17 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-blacklist-specific-hosts-so-Splunk-will-not-index-their/m-p/212550#M41790 rakeshcse2 2015-09-02T19:08:17Z Re: How to blacklist specific hosts so Splunk will not index their IIS logs in our "iis" index? https://community.splunk.com/t5/Getting-Data-In/How-to-blacklist-specific-hosts-so-Splunk-will-not-index-their/m-p/212551#M41791 <P>a blacklist is a regex, so you may want to do :</P> <PRE><CODE>blacklist = (Server1|Server2) </CODE></PRE> <P>beware this is also case sensitive.</P> Wed, 02 Sep 2015 21:36:50 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-blacklist-specific-hosts-so-Splunk-will-not-index-their/m-p/212551#M41791 yannK 2015-09-02T21:36:50Z Re: How to blacklist specific hosts so Splunk will not index their IIS logs in our "iis" index? https://community.splunk.com/t5/Getting-Data-In/How-to-blacklist-specific-hosts-so-Splunk-will-not-index-their/m-p/212552#M41792 <P>Does each of your servers have Splunk forwarder installed and they have this monitor stanza to send the logs to your Indexer??</P> Wed, 02 Sep 2015 21:56:37 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-blacklist-specific-hosts-so-Splunk-will-not-index-their/m-p/212552#M41792 somesoni2 2015-09-02T21:56:37Z Re: How to blacklist specific hosts so Splunk will not index their IIS logs in our "iis" index? https://community.splunk.com/t5/Getting-Data-In/How-to-blacklist-specific-hosts-so-Splunk-will-not-index-their/m-p/212553#M41793 <P>Yes, each of the hosts have the forwarder installed and they are managed by a central server.</P> Wed, 02 Sep 2015 22:30:12 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-blacklist-specific-hosts-so-Splunk-will-not-index-their/m-p/212553#M41793 rakeshcse2 2015-09-02T22:30:12Z