https://community.splunk.com/t5/Getting-Data-In/Trying-to-filter-logs-in-the-inputs-not-working/m-p/33622#M6023 <P>Trying to filter the backdated logs which has appeared from till yesterday and start with recent logs</P> <P>[monitor:///dir1/app/app1/jboss/server/default/log/localhost_access_log.*]<BR /> index = index_filter_local<BR /> _blacklist = (localhost_access_log.2011-11-30.log|localhost_access_log.2011-12-[01-11])</P> <P>I tried to filter using the _blacklist but this is not working , i don't see the indexing itself is happening</P> Mon, 28 Sep 2020 10:13:15 GMT saravanababumr 2020-09-28T10:13:15Z https://community.splunk.com/t5/Getting-Data-In/Trying-to-filter-logs-in-the-inputs-not-working/m-p/33622#M6023 <P>Trying to filter the backdated logs which has appeared from till yesterday and start with recent logs</P> <P>[monitor:///dir1/app/app1/jboss/server/default/log/localhost_access_log.*]<BR /> index = index_filter_local<BR /> _blacklist = (localhost_access_log.2011-11-30.log|localhost_access_log.2011-12-[01-11])</P> <P>I tried to filter using the _blacklist but this is not working , i don't see the indexing itself is happening</P> Mon, 28 Sep 2020 10:13:15 GMT https://community.splunk.com/t5/Getting-Data-In/Trying-to-filter-logs-in-the-inputs-not-working/m-p/33622#M6023 saravanababumr 2020-09-28T10:13:15Z https://community.splunk.com/t5/Getting-Data-In/Trying-to-filter-logs-in-the-inputs-not-working/m-p/33623#M6024 <P>Have you tried using the "ignoreOlderThan" property in your monitor stanza ?</P> <PRE><CODE>[monitor:///dir1/app/app1/jboss/server/default/log/localhost_access_log.*] index = index_filter_local ignoreOlderThan = 1d </CODE></PRE> Tue, 13 Dec 2011 06:45:13 GMT https://community.splunk.com/t5/Getting-Data-In/Trying-to-filter-logs-in-the-inputs-not-working/m-p/33623#M6024 Damien_Dallimor 2011-12-13T06:45:13Z