https://community.splunk.com/t5/Getting-Data-In/Multiple-blacklist-paths-in-one-stanza/m-p/42411#M7887 <P>I'm pretty sure this is incorrect:</P> <PRE><CODE>recursive = true blacklist = conc/out/* blacklist = reports/cache/* </CODE></PRE> <P>Would a correct line look more like this?</P> <PRE><CODE>blacklist = (conc/out/*|reports/cache/*) </CODE></PRE> Thu, 29 Dec 2011 23:40:17 GMT mikeely 2011-12-29T23:40:17Z https://community.splunk.com/t5/Getting-Data-In/Multiple-blacklist-paths-in-one-stanza/m-p/42411#M7887 <P>I'm pretty sure this is incorrect:</P> <PRE><CODE>recursive = true blacklist = conc/out/* blacklist = reports/cache/* </CODE></PRE> <P>Would a correct line look more like this?</P> <PRE><CODE>blacklist = (conc/out/*|reports/cache/*) </CODE></PRE> Thu, 29 Dec 2011 23:40:17 GMT https://community.splunk.com/t5/Getting-Data-In/Multiple-blacklist-paths-in-one-stanza/m-p/42411#M7887 mikeely 2011-12-29T23:40:17Z https://community.splunk.com/t5/Getting-Data-In/Multiple-blacklist-paths-in-one-stanza/m-p/42412#M7888 <P>Yes, your first example is incorrect. Only one of the blacklists will take effect. And, yes, using the regex <CODE>|</CODE> should be valid as well..</P> Fri, 30 Dec 2011 01:01:56 GMT https://community.splunk.com/t5/Getting-Data-In/Multiple-blacklist-paths-in-one-stanza/m-p/42412#M7888 dwaddle 2011-12-30T01:01:56Z