https://community.splunk.com/t5/Getting-Data-In/Need-to-filter-some-logs-from-my-inputs/m-p/33602#M6022 <P>Have you tried using the "ignoreOlderThan" property in your monitor stanza ?</P> <PRE><CODE>[monitor:///dir1/app/app1/jboss/server/default/log/localhost_access_log.*] index = index_filter_local ignoreOlderThan = 1d </CODE></PRE> Tue, 13 Dec 2011 06:42:49 GMT Damien_Dallimor 2011-12-13T06:42:49Z https://community.splunk.com/t5/Getting-Data-In/Need-to-filter-some-logs-from-my-inputs/m-p/33601#M6021 <P>Trying to filter the backdated logs which has appeared from till yesterday and start with recent logs</P> <P>[monitor:///dir1/app/app1/jboss/server/default/log/localhost_access_log.*]<BR /> index = index_filter_local<BR /> _blacklist = (localhost_access_log.2011-11-30.log|localhost_access_log.2011-12-[01-11])</P> <P>I tried to filter using the _blacklist but this is not working , i don't see the indexing itself is happening</P> Mon, 28 Sep 2020 10:13:12 GMT https://community.splunk.com/t5/Getting-Data-In/Need-to-filter-some-logs-from-my-inputs/m-p/33601#M6021 saravanababumr 2020-09-28T10:13:12Z https://community.splunk.com/t5/Getting-Data-In/Need-to-filter-some-logs-from-my-inputs/m-p/33602#M6022 <P>Have you tried using the "ignoreOlderThan" property in your monitor stanza ?</P> <PRE><CODE>[monitor:///dir1/app/app1/jboss/server/default/log/localhost_access_log.*] index = index_filter_local ignoreOlderThan = 1d </CODE></PRE> Tue, 13 Dec 2011 06:42:49 GMT https://community.splunk.com/t5/Getting-Data-In/Need-to-filter-some-logs-from-my-inputs/m-p/33602#M6022 Damien_Dallimor 2011-12-13T06:42:49Z