https://community.splunk.com/t5/Splunk-Search/blacklist-not-working-condition/m-p/346050#M159589 <P>sourcetype=XyzProd <BR /> blacklist = MethodExecutionInfo(\d{8})-(\d{2}).txt|DebugInfo(\d{8})-(\d{2}).txt|CacheRefreshInfo(\d{8})-(\d{2}).txt</P> <P>I want to add below one</P> <P>|<EM>currency</EM>(\d{8})-(\d{2}).txt<BR /> It's not working</P> Wed, 02 Aug 2017 16:55:19 GMT puneethgowda 2017-08-02T16:55:19Z https://community.splunk.com/t5/Splunk-Search/blacklist-not-working-condition/m-p/346050#M159589 <P>sourcetype=XyzProd <BR /> blacklist = MethodExecutionInfo(\d{8})-(\d{2}).txt|DebugInfo(\d{8})-(\d{2}).txt|CacheRefreshInfo(\d{8})-(\d{2}).txt</P> <P>I want to add below one</P> <P>|<EM>currency</EM>(\d{8})-(\d{2}).txt<BR /> It's not working</P> Wed, 02 Aug 2017 16:55:19 GMT https://community.splunk.com/t5/Splunk-Search/blacklist-not-working-condition/m-p/346050#M159589 puneethgowda 2017-08-02T16:55:19Z https://community.splunk.com/t5/Splunk-Search/blacklist-not-working-condition/m-p/346051#M159590 <P>(MethodExecutionInfo|DebugInfo|CacheRefreshInfo|.<EM>currency.</EM>)((\d{8})-(\d{2})).txt</P> <P>Got the answer from slack</P> Wed, 02 Aug 2017 17:01:17 GMT https://community.splunk.com/t5/Splunk-Search/blacklist-not-working-condition/m-p/346051#M159590 puneethgowda 2017-08-02T17:01:17Z