https://community.splunk.com/t5/Getting-Data-In/How-come-replicationBlacklist-is-not-working/m-p/382740#M93899 <P>The replicationBlacklist support regex but it appends "$SPLUNK_HOME/etc" to the regex you configured. i.e, SPLUNK_HOME=/opt/splunk<BR /> When splunk applies the regex above, it would be like "/opt/splunk/<A href="https://community.splunk.com/backups" target="_blank">\/_.-</A>[_.-\/] ", which is the reason your lookup files are not filtered out by the blacklist.</P> <P>Please try the below;</P> <P><EM>[replicationBlacklist]<BR /> blacklist_lookups = apps/*/lookups/lookup_file_backups/*.csv</EM></P> Tue, 29 Sep 2020 21:58:11 GMT sylim_splunk 2020-09-29T21:58:11Z https://community.splunk.com/t5/Getting-Data-In/How-come-replicationBlacklist-is-not-working/m-p/382739#M93898 <P>We have a list of large lookup files that are not supposed to be included in the search bundles. Their configurations are below. However, we have found that they are still in the bundle.</P> <PRE><CODE>[replicationBlacklist] blacklist_lookups = [\/\_\.\-](backups)[_\.\-\/\\] </CODE></PRE> <P>The files looks like this in the file system;</P> <PRE><CODE>apps/DA-ESS-AccessProtection/lookups/lookup_file_backups/abc2.csv apps/DA-ESS-AccessProtection/lookups/lookup_file_backups/bcd1.csv apps/search/lookups/lookup_file_backups/abcd5.csv apps/DA-ESS-ThreatIntelligence/lookups/lookup_file_backups/abcd4 apps/SplunkEnterpriseSecuritySuite/lookups/lookup_file_backups/xyz10.csv </CODE></PRE> <P>I've checked this regex in "regex101.com" which works fine for the above.</P> Mon, 12 Nov 2018 18:14:08 GMT https://community.splunk.com/t5/Getting-Data-In/How-come-replicationBlacklist-is-not-working/m-p/382739#M93898 sylim_splunk 2018-11-12T18:14:08Z https://community.splunk.com/t5/Getting-Data-In/How-come-replicationBlacklist-is-not-working/m-p/382740#M93899 <P>The replicationBlacklist support regex but it appends "$SPLUNK_HOME/etc" to the regex you configured. i.e, SPLUNK_HOME=/opt/splunk<BR /> When splunk applies the regex above, it would be like "/opt/splunk/<A href="https://community.splunk.com/backups" target="_blank">\/_.-</A>[_.-\/] ", which is the reason your lookup files are not filtered out by the blacklist.</P> <P>Please try the below;</P> <P><EM>[replicationBlacklist]<BR /> blacklist_lookups = apps/*/lookups/lookup_file_backups/*.csv</EM></P> Tue, 29 Sep 2020 21:58:11 GMT https://community.splunk.com/t5/Getting-Data-In/How-come-replicationBlacklist-is-not-working/m-p/382740#M93899 sylim_splunk 2020-09-29T21:58:11Z