https://community.splunk.com/t5/Getting-Data-In/How-come-I-can-t-get-the-Splunk-blacklist-subfolder-to-work/m-p/410149#M72702 <P>hi </P> <P>it is not working. i also tried -</P> <P>blacklist = ///xxx/jboss/data/log/main/app-data/log/* <BR /> blacklist = xxx/jboss/data/log/main/app-data/log/* </P> Mon, 26 Nov 2018 10:44:18 GMT keishamtcs 2018-11-26T10:44:18Z https://community.splunk.com/t5/Getting-Data-In/How-come-I-can-t-get-the-Splunk-blacklist-subfolder-to-work/m-p/410147#M72700 <P>hi,</P> <P>I am trying to blacklist a subfolder in a particular directory.</P> <P>The subfolder i am trying to blacklist is app-Status and app-data.</P> <P>I have used the blacklist as mentioned below but it is not working. How to remove these two folders from logging data?</P> <PRE><CODE>[monitor:///xxx/jboss/data/log/main/app*/log] disabled=false blacklist = ///xxx/jboss/data/log/main/(app-Status|app-data)/log ignoreOlderThan = 24h _TCP_ROUTING=xyz sourcetype=abc index=xxxxxx </CODE></PRE> Fri, 23 Nov 2018 13:30:48 GMT https://community.splunk.com/t5/Getting-Data-In/How-come-I-can-t-get-the-Splunk-blacklist-subfolder-to-work/m-p/410147#M72700 keishamtcs 2018-11-23T13:30:48Z https://community.splunk.com/t5/Getting-Data-In/How-come-I-can-t-get-the-Splunk-blacklist-subfolder-to-work/m-p/410148#M72701 <PRE><CODE>blacklist = /xxx/jboss/data/log/main/app-data/log/* | /xxx/jboss/data/log/main/app-Status/log/* </CODE></PRE> Fri, 23 Nov 2018 14:47:34 GMT https://community.splunk.com/t5/Getting-Data-In/How-come-I-can-t-get-the-Splunk-blacklist-subfolder-to-work/m-p/410148#M72701 jbrocks 2018-11-23T14:47:34Z https://community.splunk.com/t5/Getting-Data-In/How-come-I-can-t-get-the-Splunk-blacklist-subfolder-to-work/m-p/410149#M72702 <P>hi </P> <P>it is not working. i also tried -</P> <P>blacklist = ///xxx/jboss/data/log/main/app-data/log/* <BR /> blacklist = xxx/jboss/data/log/main/app-data/log/* </P> Mon, 26 Nov 2018 10:44:18 GMT https://community.splunk.com/t5/Getting-Data-In/How-come-I-can-t-get-the-Splunk-blacklist-subfolder-to-work/m-p/410149#M72702 keishamtcs 2018-11-26T10:44:18Z https://community.splunk.com/t5/Getting-Data-In/How-come-I-can-t-get-the-Splunk-blacklist-subfolder-to-work/m-p/410150#M72703 <P>Or just simply <CODE>blacklist = (app-Status|app-data)</CODE>. The regex doesn't have to match the full path.</P> Mon, 26 Nov 2018 11:14:11 GMT https://community.splunk.com/t5/Getting-Data-In/How-come-I-can-t-get-the-Splunk-blacklist-subfolder-to-work/m-p/410150#M72703 FrankVl 2018-11-26T11:14:11Z https://community.splunk.com/t5/Getting-Data-In/How-come-I-can-t-get-the-Splunk-blacklist-subfolder-to-work/m-p/410151#M72704 <P>Did you try with one slash? <BR /> blacklist = /xxx/jboss/data/log/main/app-data/log/*</P> Mon, 26 Nov 2018 14:01:40 GMT https://community.splunk.com/t5/Getting-Data-In/How-come-I-can-t-get-the-Splunk-blacklist-subfolder-to-work/m-p/410151#M72704 jbrocks 2018-11-26T14:01:40Z https://community.splunk.com/t5/Getting-Data-In/How-come-I-can-t-get-the-Splunk-blacklist-subfolder-to-work/m-p/410152#M72705 <P>Hi,</P> <P>i tried like the below syntax and it is working. Thanks for your input.<BR /> blacklist = //xxx/jboss/data/log/main/app-data/log/</P> Wed, 28 Nov 2018 09:51:42 GMT https://community.splunk.com/t5/Getting-Data-In/How-come-I-can-t-get-the-Splunk-blacklist-subfolder-to-work/m-p/410152#M72705 keishamtcs 2018-11-28T09:51:42Z