https://community.splunk.com/t5/Dashboards-Visualizations/REGEX-for-the-blacklist/m-p/388689#M42749 <P>Hi @damucka,</P> <P>Try this regex for blacklist <CODE>indexserver_ls\d+\.\d+_\w+\.trc</CODE></P> Tue, 08 Jan 2019 13:12:17 GMT harsmarvania57 2019-01-08T13:12:17Z https://community.splunk.com/t5/Dashboards-Visualizations/REGEX-for-the-blacklist/m-p/388688#M42748 <P>Hello,</P> <P>I need help with the REGEX for my blacklist. I have the following file pattern on the source:</P> <PRE><CODE>indexserver_ls5783.30240.341.trc </CODE></PRE> <P>but sometimes the end users switch additional traces, which follow the pattern:</P> <PRE><CODE>indexserver_ls5783.30240_trc115.trc </CODE></PRE> <P>On the example above, the user activated additional trace with the context name "trc115", which has been appended to the name after underline replacing the tracefile number.<BR /> Now, I would like to blacklist these user defined traces.<BR /> The starting point for the blacklist regex would be the 5 digits (this is the port number and does not have to be always 30240) + "_" + string + ".trc"<BR /> Could you help me with the corresponding blacklist REGEX?</P> <P>Kind Regards,<BR /> Kamil</P> Tue, 08 Jan 2019 13:01:29 GMT https://community.splunk.com/t5/Dashboards-Visualizations/REGEX-for-the-blacklist/m-p/388688#M42748 damucka 2019-01-08T13:01:29Z https://community.splunk.com/t5/Dashboards-Visualizations/REGEX-for-the-blacklist/m-p/388689#M42749 <P>Hi @damucka,</P> <P>Try this regex for blacklist <CODE>indexserver_ls\d+\.\d+_\w+\.trc</CODE></P> Tue, 08 Jan 2019 13:12:17 GMT https://community.splunk.com/t5/Dashboards-Visualizations/REGEX-for-the-blacklist/m-p/388689#M42749 harsmarvania57 2019-01-08T13:12:17Z