https://community.splunk.com/t5/Getting-Data-In/Issue-with-Blacklist-in-Inputs-conf/m-p/368346#M66914 <P>Monitor path is "///data/xyz/logs/"</P> <P>There are multiple dynamic folders under logs<BR /> abc<BR /> qwe<BR /> poi</P> <P>Also there is a file "router.jar.log" inside logs folder. I want to black list it. But want to index a file "abc-router.jar.log" present in /logs/abc/</P> Thu, 28 Sep 2017 07:35:09 GMT vaibhavagg2006 2017-09-28T07:35:09Z https://community.splunk.com/t5/Getting-Data-In/Issue-with-Blacklist-in-Inputs-conf/m-p/368344#M66912 <P>Hi Experts<BR /> I have following monitor stanza . I want to blacklist "data/xyz/logs/router.jar.log" but want to monitor "/data/xyz/logs/abc/abc-router/abc-router.jar.log" . Though I have mentioned router.* still is blacklisting "abc-router.jar.log". Please help here</P> <P>[monitor:///data/xyz/logs/]<BR /> index = test<BR /> sourcetype = test_st<BR /> whitelist=\.jar\.log$<BR /> blacklist=discovery.*|router.*|java.*<BR /> disabled = 0 </P> Thu, 28 Sep 2017 07:21:16 GMT https://community.splunk.com/t5/Getting-Data-In/Issue-with-Blacklist-in-Inputs-conf/m-p/368344#M66912 vaibhavagg2006 2017-09-28T07:21:16Z https://community.splunk.com/t5/Getting-Data-In/Issue-with-Blacklist-in-Inputs-conf/m-p/368345#M66913 <P>may i know, if the monitor path was correct in the question?!?!</P> <P><CODE>[monitor:///data/xyz/logs/abc/abc-router/]<BR /> index = test<BR /> sourcetype = test_st<BR /> whitelist=.jar.log$<BR /> blacklist=discovery\.|router\.|java\.*<BR /> disabled = 0</CODE></P> Thu, 28 Sep 2017 07:31:20 GMT https://community.splunk.com/t5/Getting-Data-In/Issue-with-Blacklist-in-Inputs-conf/m-p/368345#M66913 inventsekar 2017-09-28T07:31:20Z https://community.splunk.com/t5/Getting-Data-In/Issue-with-Blacklist-in-Inputs-conf/m-p/368346#M66914 <P>Monitor path is "///data/xyz/logs/"</P> <P>There are multiple dynamic folders under logs<BR /> abc<BR /> qwe<BR /> poi</P> <P>Also there is a file "router.jar.log" inside logs folder. I want to black list it. But want to index a file "abc-router.jar.log" present in /logs/abc/</P> Thu, 28 Sep 2017 07:35:09 GMT https://community.splunk.com/t5/Getting-Data-In/Issue-with-Blacklist-in-Inputs-conf/m-p/368346#M66914 vaibhavagg2006 2017-09-28T07:35:09Z https://community.splunk.com/t5/Getting-Data-In/Issue-with-Blacklist-in-Inputs-conf/m-p/368347#M66915 <P>Hi vaibhavagg2006,<BR /> maybe you alredy tested this solution:</P> <PRE><CODE>[monitor:///data/xyz/logs/] index = test sourcetype = test_st whitelist=\.jar\.log$ blacklist=(discovery|router|java)\/abc-router\.jar\.log disabled = 0 </CODE></PRE> <P>Bye.<BR /> Giuseppe</P> Thu, 28 Sep 2017 07:41:52 GMT https://community.splunk.com/t5/Getting-Data-In/Issue-with-Blacklist-in-Inputs-conf/m-p/368347#M66915 gcusello 2017-09-28T07:41:52Z https://community.splunk.com/t5/Getting-Data-In/Issue-with-Blacklist-in-Inputs-conf/m-p/368348#M66916 <OL> <LI>maybe, try whitelist alone(without blacklist) and blacklist alone, then together..</LI> <LI><CODE>whitelist=\.jar\.log$</CODE></LI> <LI><CODE>blacklist=discovery\.|router\.|java\.*</CODE></LI> </OL> Thu, 28 Sep 2017 07:49:46 GMT https://community.splunk.com/t5/Getting-Data-In/Issue-with-Blacklist-in-Inputs-conf/m-p/368348#M66916 inventsekar 2017-09-28T07:49:46Z https://community.splunk.com/t5/Getting-Data-In/Issue-with-Blacklist-in-Inputs-conf/m-p/368349#M66917 <P>Thanks for your inputs<BR /> I do not want to blacklist /logs/abc/abc-router.jar.log<BR /> Only want to blacklist /logs/router.jar.log</P> Thu, 28 Sep 2017 07:51:44 GMT https://community.splunk.com/t5/Getting-Data-In/Issue-with-Blacklist-in-Inputs-conf/m-p/368349#M66917 vaibhavagg2006 2017-09-28T07:51:44Z https://community.splunk.com/t5/Getting-Data-In/Issue-with-Blacklist-in-Inputs-conf/m-p/368350#M66918 <P>try</P> <PRE><CODE> [monitor:///data/xyz/] index = test sourcetype = test_st whitelist=logs\/\.jar\.log$ blacklist=(discovery|router|java)\/abc-router\.jar\.log disabled = 0 </CODE></PRE> <P>Bye.<BR /> Giuseppe</P> Thu, 28 Sep 2017 08:36:48 GMT https://community.splunk.com/t5/Getting-Data-In/Issue-with-Blacklist-in-Inputs-conf/m-p/368350#M66918 gcusello 2017-09-28T08:36:48Z