How come I can't get the Splunk blacklist subfolder to work?

[keishamtcs]

hi,

I am trying to blacklist a subfolder in a particular directory.

The subfolder i am trying to blacklist is app-Status and app-data.

I have used the blacklist as mentioned below but it is not working. How to remove these two folders from logging data?

[monitor:///xxx/jboss/data/log/main/app*/log]
disabled=false
blacklist = ///xxx/jboss/data/log/main/(app-Status|app-data)/log
ignoreOlderThan = 24h
_TCP_ROUTING=xyz
sourcetype=abc
index=xxxxxx

[FrankVl]

Or just simply blacklist = (app-Status|app-data). The regex doesn't have to match the full path.

[jbrocks]

blacklist = /xxx/jboss/data/log/main/app-data/log/* | /xxx/jboss/data/log/main/app-Status/log/*

[keishamtcs]

hi

it is not working. i also tried -

blacklist = ///xxx/jboss/data/log/main/app-data/log/*
blacklist = xxx/jboss/data/log/main/app-data/log/*

[jbrocks]

Did you try with one slash?
blacklist = /xxx/jboss/data/log/main/app-data/log/*

[keishamtcs]

Hi,

i tried like the below syntax and it is working. Thanks for your input.
blacklist = //xxx/jboss/data/log/main/app-data/log/