https://community.splunk.com/t5/Getting-Data-In/Blacklist-patterns-not-working-in-inputs-conf/m-p/317486#M59353 <P>The <CODE>blacklist</CODE> attribute uses regular expressions, not patterns. Try these settings.</P> <PRE><CODE>blacklist= (op_fe-run_autostat.* | op_fe-proteus_prod_archive_E.*) </CODE></PRE> Wed, 17 Jan 2018 13:59:22 GMT richgalloway 2018-01-17T13:59:22Z https://community.splunk.com/t5/Getting-Data-In/Blacklist-patterns-not-working-in-inputs-conf/m-p/317485#M59352 <P>I want to blacklist below two logs from my index.</P> <P>Log 1: op_fe-run_autostat*<BR /> Log 2: op_fe-run_autostat*</P> <P>I tried below configurations in inputs.conf but none of them are working. Can you please check.</P> <P>Pattern 1:-</P> <P>blacklist1 = op_fe-run_autostat*<BR /> blacklist2 = op_fe-proteus_prod_archive_E*</P> <P>pattern 2: </P> <P>blacklist= (op_fe-run_autostat* | op_fe-proteus_prod_archive_E*)</P> <P>Pattern 3:</P> <P>blacklist1 = source="op_fe-run_autostat*"<BR /> blacklist2 = source="op_fe-proteus_prod_archive_E*"</P> Tue, 29 Sep 2020 17:44:11 GMT https://community.splunk.com/t5/Getting-Data-In/Blacklist-patterns-not-working-in-inputs-conf/m-p/317485#M59352 AnmolKohli 2020-09-29T17:44:11Z https://community.splunk.com/t5/Getting-Data-In/Blacklist-patterns-not-working-in-inputs-conf/m-p/317486#M59353 <P>The <CODE>blacklist</CODE> attribute uses regular expressions, not patterns. Try these settings.</P> <PRE><CODE>blacklist= (op_fe-run_autostat.* | op_fe-proteus_prod_archive_E.*) </CODE></PRE> Wed, 17 Jan 2018 13:59:22 GMT https://community.splunk.com/t5/Getting-Data-In/Blacklist-patterns-not-working-in-inputs-conf/m-p/317486#M59353 richgalloway 2018-01-17T13:59:22Z