https://community.splunk.com/t5/Getting-Data-In/How-to-develop-a-regular-expression-that-will-blacklist-my-log/m-p/365264#M66504 <P>Some cheerful examples in the documentation at <A href="https://docs.splunk.com/Documentation/Splunk/6.5.3/Data/Whitelistorblacklistspecificincomingdata">Whitelist- or blacklist-specific incoming data</A> </P> <P>It shows - </P> <P><span class="lia-inline-image-display-wrapper" image-alt="![alt text][2]"><img src="https://community.splunk.com/t5/image/serverpage/image-id/2890i9CD8719537CA1886/image-size/large?v=v2&amp;px=999" role="button" title="![alt text][2]" alt="![alt text][2]" /></span></P> Sun, 07 May 2017 00:32:20 GMT ddrillic 2017-05-07T00:32:20Z https://community.splunk.com/t5/Getting-Data-In/How-to-develop-a-regular-expression-that-will-blacklist-my-log/m-p/365260#M66500 <P>Below is my monitoring path</P> <PRE><CODE>[monitor:///wasapps/WAS85/logs/restconnect_alppapp102was85Node01] </CODE></PRE> <P>I want to blacklist the below files</P> <PRE><CODE>/wasapps/WAS85/logs/restconnect_alppapp102was85Node01/restConnectApp.log /wasapps/WAS85/logs/restconnect_alppapp102was85Node01/restConnectPerformance.log </CODE></PRE> <P>I have tried the below regex, but none of them worked.</P> <PRE><CODE>[monitor:///wasapps/WAS85/logs/restconnect_alppapp102was85Node01] blacklist = restConnect*\.(log)$ blacklist = restConnect[App|Performance]\.(log)$ </CODE></PRE> <P>Can someone please help?</P> Fri, 05 May 2017 16:26:54 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-develop-a-regular-expression-that-will-blacklist-my-log/m-p/365260#M66500 ppanchal 2017-05-05T16:26:54Z https://community.splunk.com/t5/Getting-Data-In/How-to-develop-a-regular-expression-that-will-blacklist-my-log/m-p/365261#M66501 <PRE><CODE>blacklist = restConnect.*\.log$ </CODE></PRE> <P>This should blacklist every file that starts with "restConnect" and ends with .log</P> Fri, 05 May 2017 16:45:37 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-develop-a-regular-expression-that-will-blacklist-my-log/m-p/365261#M66501 ckunath 2017-05-05T16:45:37Z https://community.splunk.com/t5/Getting-Data-In/How-to-develop-a-regular-expression-that-will-blacklist-my-log/m-p/365262#M66502 <P>I guess this did not work.<BR /> Any other solution?</P> Fri, 05 May 2017 22:16:24 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-develop-a-regular-expression-that-will-blacklist-my-log/m-p/365262#M66502 ppanchal 2017-05-05T22:16:24Z https://community.splunk.com/t5/Getting-Data-In/How-to-develop-a-regular-expression-that-will-blacklist-my-log/m-p/365263#M66503 <P>Oh, my bad. Try</P> <PRE><CODE>blacklist = .*restConnect.*\.log$ </CODE></PRE> Sat, 06 May 2017 07:46:52 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-develop-a-regular-expression-that-will-blacklist-my-log/m-p/365263#M66503 ckunath 2017-05-06T07:46:52Z https://community.splunk.com/t5/Getting-Data-In/How-to-develop-a-regular-expression-that-will-blacklist-my-log/m-p/365264#M66504 <P>Some cheerful examples in the documentation at <A href="https://docs.splunk.com/Documentation/Splunk/6.5.3/Data/Whitelistorblacklistspecificincomingdata">Whitelist- or blacklist-specific incoming data</A> </P> <P>It shows - </P> <P><span class="lia-inline-image-display-wrapper" image-alt="![alt text][2]"><img src="https://community.splunk.com/t5/image/serverpage/image-id/2890i9CD8719537CA1886/image-size/large?v=v2&amp;px=999" role="button" title="![alt text][2]" alt="![alt text][2]" /></span></P> Sun, 07 May 2017 00:32:20 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-develop-a-regular-expression-that-will-blacklist-my-log/m-p/365264#M66504 ddrillic 2017-05-07T00:32:20Z