topic How to blacklist data containing specific words in Getting Data In https://community.splunk.com/t5/Getting-Data-In/How-to-blacklist-data-containing-specific-words/m-p/424708#M74483 <P>I have found that there are lots of syslog contains <STRONG>"Log statistics"</STRONG>, which is log statistic data of syslog. <BR /> Splunk could not parse it well and I do not want to index this data. </P> <P>How I can blacklist it in the inputs.conf?</P> Wed, 12 Jun 2019 23:10:29 GMT bli_scs 2019-06-12T23:10:29Z How to blacklist data containing specific words https://community.splunk.com/t5/Getting-Data-In/How-to-blacklist-data-containing-specific-words/m-p/424708#M74483 <P>I have found that there are lots of syslog contains <STRONG>"Log statistics"</STRONG>, which is log statistic data of syslog. <BR /> Splunk could not parse it well and I do not want to index this data. </P> <P>How I can blacklist it in the inputs.conf?</P> Wed, 12 Jun 2019 23:10:29 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-blacklist-data-containing-specific-words/m-p/424708#M74483 bli_scs 2019-06-12T23:10:29Z Re: How to blacklist data containing specific words https://community.splunk.com/t5/Getting-Data-In/How-to-blacklist-data-containing-specific-words/m-p/424709#M74484 <P>@bli_scs</P> <P>From the inputs.conf we can do the blacklisting at file or directory level. See here - <BR /> <A href="https://docs.splunk.com/Documentation/SplunkCloud/latest/Data/Whitelistorblacklistspecificincomingdata#Blacklist_.28ignore.29_files">https://docs.splunk.com/Documentation/SplunkCloud/latest/Data/Whitelistorblacklistspecificincomingdata#Blacklist_.28ignore.29_files</A></P> <P>However to perform the blacklisting which is event based (on some criteria like in your case that the event contains "Log statistics"), you can use a Heavy Forwarder, which processes both the input phase and the parsing phase before forwarding. <BR /> and on your HF, you can define the filtering rule on your props.conf and transforms.conf<BR /> For defining a filtering rule, this post can help you - <BR /> <A href="https://answers.splunk.com/answers/59370/filtering-events-using-nullqueue-1.html">https://answers.splunk.com/answers/59370/filtering-events-using-nullqueue-1.html</A></P> <P>Please accept as answer if this responds to your query.<BR /> Thanks</P> Thu, 13 Jun 2019 13:39:13 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-blacklist-data-containing-specific-words/m-p/424709#M74484 amitm05 2019-06-13T13:39:13Z