https://community.splunk.com/t5/Getting-Data-In/Blacklist-regular-expression-not-working/m-p/321475#M59941 <P>I want to blacklist below 2 files:</P> <P>op_fe-run_autostat*.log<BR /> op_fe-proteus_prod_archive*.log</P> <UL> <LI>here can be any number/characters</LI> </UL> <P>I used below regex but the same is not working. Can someone please help.</P> <P>blacklist = .(run_autostat|proteus_prod_archive).log$</P> Tue, 29 Sep 2020 17:04:49 GMT AnmolKohli 2020-09-29T17:04:49Z https://community.splunk.com/t5/Getting-Data-In/Blacklist-regular-expression-not-working/m-p/321475#M59941 <P>I want to blacklist below 2 files:</P> <P>op_fe-run_autostat*.log<BR /> op_fe-proteus_prod_archive*.log</P> <UL> <LI>here can be any number/characters</LI> </UL> <P>I used below regex but the same is not working. Can someone please help.</P> <P>blacklist = .(run_autostat|proteus_prod_archive).log$</P> Tue, 29 Sep 2020 17:04:49 GMT https://community.splunk.com/t5/Getting-Data-In/Blacklist-regular-expression-not-working/m-p/321475#M59941 AnmolKohli 2020-09-29T17:04:49Z https://community.splunk.com/t5/Getting-Data-In/Blacklist-regular-expression-not-working/m-p/321476#M59942 <P>shouldn't it be </P> <PRE><CODE>.(run_autostat|proteus_prod_archive).*\.log$ </CODE></PRE> Wed, 06 Dec 2017 13:05:06 GMT https://community.splunk.com/t5/Getting-Data-In/Blacklist-regular-expression-not-working/m-p/321476#M59942 teunlaan 2017-12-06T13:05:06Z https://community.splunk.com/t5/Getting-Data-In/Blacklist-regular-expression-not-working/m-p/321477#M59943 <P>Can you please post your filename and regex with <CODE>Code Sample format (Please use button 101010)</CODE> </P> Wed, 06 Dec 2017 13:09:49 GMT https://community.splunk.com/t5/Getting-Data-In/Blacklist-regular-expression-not-working/m-p/321477#M59943 harsmarvania57 2017-12-06T13:09:49Z https://community.splunk.com/t5/Getting-Data-In/Blacklist-regular-expression-not-working/m-p/321478#M59944 <P>inputs.conf?</P> <P>You should include one of these keys: <A href="http://docs.splunk.com/Documentation/Splunk/6.4.2/Data/MonitorWindowseventlogdata#Create_advanced_filters_with_.27whitelist.27_and_.27blacklist.27" target="_blank">http://docs.splunk.com/Documentation/Splunk/6.4.2/Data/MonitorWindowseventlogdata#Create_advanced_filters_with_.27whitelist.27_and_.27blacklist.27</A></P> <P>so yours might be something like:<BR /> blacklist1 = Message=%.<EM>(run_autostat|proteus_prod_archive).</EM>.log%</P> <P>depending on where the string is in the message field, in might also be<BR /> blacklist1 = Message=%^.<EM>(run_autostat|proteus_prod_archive).</EM>.log$%</P> Tue, 29 Sep 2020 17:14:16 GMT https://community.splunk.com/t5/Getting-Data-In/Blacklist-regular-expression-not-working/m-p/321478#M59944 amaynardclarku 2020-09-29T17:14:16Z