https://community.splunk.com/t5/Getting-Data-In/whitelist-blacklist-inputs-conf-not-respected/m-p/533327#M89581 <P>Hi,</P><P>&nbsp;</P><P>Your blacklist not correct, if you want to blacklist pre-anaconda.log then use below blacklist.</P><LI-CODE lang="markup">blacklist=(lastlog|pre-anaconda\.log)</LI-CODE> Wed, 16 Dec 2020 13:16:55 GMT harsmarvania57 2020-12-16T13:16:55Z https://community.splunk.com/t5/Getting-Data-In/whitelist-blacklist-inputs-conf-not-respected/m-p/533322#M89580 <P>Hello guys,</P><P>we used this in inputs.conf according to the Splunk CIM compliant addon for Unix and Linux :</P><P><BR />[monitor:///var/log]<BR />whitelist=(messages|secure|auth|maillog|audit\.log|cron)<BR />blacklist=(lastlog|anaconda\.syslog)<BR />disabled = 0<BR />index = linux</P><P>However on UF it still looked for /var/log/anaconda/pre-anaconda.log and others, this looks weird behaviour?</P><P>Thanks.</P><P>Splunk enterprise 7.3.4</P><P>UF 7.1.4</P><P>&nbsp;</P> Wed, 16 Dec 2020 12:33:00 GMT https://community.splunk.com/t5/Getting-Data-In/whitelist-blacklist-inputs-conf-not-respected/m-p/533322#M89580 splunkreal 2020-12-16T12:33:00Z https://community.splunk.com/t5/Getting-Data-In/whitelist-blacklist-inputs-conf-not-respected/m-p/533327#M89581 <P>Hi,</P><P>&nbsp;</P><P>Your blacklist not correct, if you want to blacklist pre-anaconda.log then use below blacklist.</P><LI-CODE lang="markup">blacklist=(lastlog|pre-anaconda\.log)</LI-CODE> Wed, 16 Dec 2020 13:16:55 GMT https://community.splunk.com/t5/Getting-Data-In/whitelist-blacklist-inputs-conf-not-respected/m-p/533327#M89581 harsmarvania57 2020-12-16T13:16:55Z