How to blacklist the events which are having a particular pattern/string?

[rajesh2010]

I need to blacklist the logs coming from network device which are having particular string. Please let me know how this can be done?

[MuS]

Hi rajesh2010,

there a multiple ways to do that, depending on your use case.

• If you want to blacklist based on file name or file ending, follow this white rabbit.
• If you only want some specific parts of your logs, follow this white rabbit

hope this helps ...

cheers, MuS

[MuS]

Props and if needed transforms must be changed

[rajesh2010]

Do we need make this changes in props.conf and transforms.conf even for Splunk 6.0.1? Is editing just in inputs.conf not enough?