https://community.splunk.com/t5/Getting-Data-In/How-to-blacklist-a-set-hosts-using-segment/m-p/482801#M82717 <P>Hi,</P> <P>I have an inputs.conf that seems to be ignoring the host entries that I've entered. Am I missing something? </P> <P>`[monitor:///data/syslog-ng/logs/unknown/.../*.log]<BR /> host_segment = 5<BR /> disabled = false<BR /> index = unknown<BR /> sourcetype = unknown_syslog<BR /> blacklist=(1.2.3.4|4.5.6.7|6.7.8.9|127.0.0.1)</P> Wed, 30 Sep 2020 04:24:38 GMT a212830 2020-09-30T04:24:38Z https://community.splunk.com/t5/Getting-Data-In/How-to-blacklist-a-set-hosts-using-segment/m-p/482801#M82717 <P>Hi,</P> <P>I have an inputs.conf that seems to be ignoring the host entries that I've entered. Am I missing something? </P> <P>`[monitor:///data/syslog-ng/logs/unknown/.../*.log]<BR /> host_segment = 5<BR /> disabled = false<BR /> index = unknown<BR /> sourcetype = unknown_syslog<BR /> blacklist=(1.2.3.4|4.5.6.7|6.7.8.9|127.0.0.1)</P> Wed, 30 Sep 2020 04:24:38 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-blacklist-a-set-hosts-using-segment/m-p/482801#M82717 a212830 2020-09-30T04:24:38Z https://community.splunk.com/t5/Getting-Data-In/How-to-blacklist-a-set-hosts-using-segment/m-p/482802#M82718 <P>Think I have it...</P> <PRE><CODE>[monitor:///data/syslog-ng/logs/unknown/.../] whitelist = \.log host_segment = 5 disabled = false index = unknown sourcetype = unknown_syslog blacklist=(1.2.3.4\/*.log|4.5.6.7\/*.log|6.7.8.9\/*.log|127.0.0.1\/*.log) </CODE></PRE> Tue, 25 Feb 2020 18:14:05 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-blacklist-a-set-hosts-using-segment/m-p/482802#M82718 a212830 2020-02-25T18:14:05Z