https://community.splunk.com/t5/Getting-Data-In/Blacklist-in-inputs-conf-not-working-as-expected/m-p/435887#M76063 <P>Hi hkkenderson,</P> <P><CODE>blacklist</CODE> is using regex to match, therefore you should use <CODE>\.</CODE> instead of just <CODE>.</CODE>. Try this:</P> <PRE><CODE> blacklist = app\.domain\.com\.access\.https\.log </CODE></PRE> <P>This assues you want to literally match <STRONG>one dot</STRONG> and not just <STRONG>anything one time</STRONG>.</P> <P>Hope this helps ...</P> <P>cheers, MuS</P> Mon, 04 Jun 2018 20:08:45 GMT MuS 2018-06-04T20:08:45Z https://community.splunk.com/t5/Getting-Data-In/Blacklist-in-inputs-conf-not-working-as-expected/m-p/435886#M76062 <P>I am attempting to monitor all the log with the word access.<BR /> But exclude one particular log file.</P> <P>Here is my inputs.conf</P> <P>[monitor:///var/log/nginx/*access*log]<BR /> index = nginx<BR /> sourcetype = access_combined<BR /> disabled = false<BR /> blacklist = app.domain.com.access.https.log</P> <P>Can I specify the log file literally? </P> Tue, 29 Sep 2020 19:49:37 GMT https://community.splunk.com/t5/Getting-Data-In/Blacklist-in-inputs-conf-not-working-as-expected/m-p/435886#M76062 khhenderson 2020-09-29T19:49:37Z https://community.splunk.com/t5/Getting-Data-In/Blacklist-in-inputs-conf-not-working-as-expected/m-p/435887#M76063 <P>Hi hkkenderson,</P> <P><CODE>blacklist</CODE> is using regex to match, therefore you should use <CODE>\.</CODE> instead of just <CODE>.</CODE>. Try this:</P> <PRE><CODE> blacklist = app\.domain\.com\.access\.https\.log </CODE></PRE> <P>This assues you want to literally match <STRONG>one dot</STRONG> and not just <STRONG>anything one time</STRONG>.</P> <P>Hope this helps ...</P> <P>cheers, MuS</P> Mon, 04 Jun 2018 20:08:45 GMT https://community.splunk.com/t5/Getting-Data-In/Blacklist-in-inputs-conf-not-working-as-expected/m-p/435887#M76063 MuS 2018-06-04T20:08:45Z