https://community.splunk.com/t5/Getting-Data-In/Blacklist-pattern-for-distsearch-conf/m-p/31264#M5486 <P>Hi</P> <P>There are a couple of options that you can use for this regex. Both of them worked for me:</P> <P>[replicationBlacklist]<BR /> sample1 = ...appname1...<BR /> sample2 = .<EM>appname2.</EM></P> <P>That would blacklist the whole lot of files from those apps, you could also only blacklist specific files from inside an app by including the whole path to the file</P> Wed, 06 Nov 2013 19:27:22 GMT asimagu 2013-11-06T19:27:22Z https://community.splunk.com/t5/Getting-Data-In/Blacklist-pattern-for-distsearch-conf/m-p/31263#M5485 <P>Does anyone have any examples of regex used in the Blacklist patterns for distsearch.conf? We are trying to limit what gets replicated in distributed searches and I thought this would be a good start. We currently have the following in our distsearch.conf:</P> <P>system [replicationBlacklist]<BR /> system lookupindexfiles = (system|(apps/(?!pdfserver)<EM>)|users(/_reserved)/</EM>/<EM>)/lookups /</EM>.index($|/...)<BR /> system sampleapp = apps/sample_app/...</P> <P>I am guessing replacing "sampleapp" with a current application that is running on my Splunk instance will stop this app from replicating. Is this correct? Do I need additional regex?</P> Thu, 19 Apr 2012 19:58:40 GMT https://community.splunk.com/t5/Getting-Data-In/Blacklist-pattern-for-distsearch-conf/m-p/31263#M5485 ride76 2012-04-19T19:58:40Z https://community.splunk.com/t5/Getting-Data-In/Blacklist-pattern-for-distsearch-conf/m-p/31264#M5486 <P>Hi</P> <P>There are a couple of options that you can use for this regex. Both of them worked for me:</P> <P>[replicationBlacklist]<BR /> sample1 = ...appname1...<BR /> sample2 = .<EM>appname2.</EM></P> <P>That would blacklist the whole lot of files from those apps, you could also only blacklist specific files from inside an app by including the whole path to the file</P> Wed, 06 Nov 2013 19:27:22 GMT https://community.splunk.com/t5/Getting-Data-In/Blacklist-pattern-for-distsearch-conf/m-p/31264#M5486 asimagu 2013-11-06T19:27:22Z