https://community.splunk.com/t5/Getting-Data-In/How-to-blacklist-two-different-hosts-in-inputs-conf/m-p/273824#M52518 <P>Hi All, Can any one guide me on how to blacklist two different host in the same inputs.conf files in Heavy Forwarder (HF) instance?</P> <P>Currently we have the below inputs.conf set and in which we have already blacklisted a host but I want to add another host along with the below host, so that the logs from this host are not indexed in the same indexer.</P> <P>example: want to blacklist sep01 logs from this path /opt/syslogs/generic/sep01/Sep01.log in the below inputs.conf </P> <PRE><CODE>[monitor:///opt/syslogs/generic/.../*.log] sourcetype = syslog host_segment = 4 blacklist = dxx*lxx* index=unix_svrs </CODE></PRE> <P>Kindly guide me on this to fix this problem. </P> <P>thanks in advance. </P> Wed, 07 Dec 2016 17:29:35 GMT Hemnaath 2016-12-07T17:29:35Z https://community.splunk.com/t5/Getting-Data-In/How-to-blacklist-two-different-hosts-in-inputs-conf/m-p/273824#M52518 <P>Hi All, Can any one guide me on how to blacklist two different host in the same inputs.conf files in Heavy Forwarder (HF) instance?</P> <P>Currently we have the below inputs.conf set and in which we have already blacklisted a host but I want to add another host along with the below host, so that the logs from this host are not indexed in the same indexer.</P> <P>example: want to blacklist sep01 logs from this path /opt/syslogs/generic/sep01/Sep01.log in the below inputs.conf </P> <PRE><CODE>[monitor:///opt/syslogs/generic/.../*.log] sourcetype = syslog host_segment = 4 blacklist = dxx*lxx* index=unix_svrs </CODE></PRE> <P>Kindly guide me on this to fix this problem. </P> <P>thanks in advance. </P> Wed, 07 Dec 2016 17:29:35 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-blacklist-two-different-hosts-in-inputs-conf/m-p/273824#M52518 Hemnaath 2016-12-07T17:29:35Z https://community.splunk.com/t5/Getting-Data-In/How-to-blacklist-two-different-hosts-in-inputs-conf/m-p/273825#M52519 <P>The <CODE>blacklist</CODE> attribute takes a regular expression so you could try something like</P> <PRE><CODE>blacklist = (dxx*lxx|.*\/sep01\/) </CODE></PRE> Wed, 07 Dec 2016 17:50:43 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-blacklist-two-different-hosts-in-inputs-conf/m-p/273825#M52519 richgalloway 2016-12-07T17:50:43Z