Getting Data In

How to develop a regular expression that will blacklist my log paths in inputs.conf?

ppanchal
Path Finder

Below is my monitoring path

[monitor:///wasapps/WAS85/logs/restconnect_alppapp102was85Node01]

I want to blacklist the below files

/wasapps/WAS85/logs/restconnect_alppapp102was85Node01/restConnectApp.log
/wasapps/WAS85/logs/restconnect_alppapp102was85Node01/restConnectPerformance.log

I have tried the below regex, but none of them worked.

[monitor:///wasapps/WAS85/logs/restconnect_alppapp102was85Node01]
blacklist = restConnect*\.(log)$
blacklist = restConnect[App|Performance]\.(log)$

Can someone please help?

0 Karma

ddrillic
Ultra Champion

Some cheerful examples in the documentation at Whitelist- or blacklist-specific incoming data

It shows -

![alt text][2]

0 Karma

ckunath
Communicator
blacklist = restConnect.*\.log$

This should blacklist every file that starts with "restConnect" and ends with .log

0 Karma

ppanchal
Path Finder

I guess this did not work.
Any other solution?

0 Karma

ckunath
Communicator

Oh, my bad. Try

blacklist = .*restConnect.*\.log$
0 Karma
Get Updates on the Splunk Community!

App Platform's 2025 Year in Review: A Year of Innovation, Growth, and Community

As we step into 2026, it’s the perfect moment to reflect on what an extraordinary year 2025 was for the Splunk ...

Operationalizing Entity Risk Score with Enterprise Security 8.3+

Overview Enterprise Security 8.3 introduces a powerful new feature called “Entity Risk Scoring” (ERS) for ...

Unlock Database Monitoring with Splunk Observability Cloud

  In today’s fast-paced digital landscape, even minor database slowdowns can disrupt user experiences and ...