Need to Add blacklist except "*string*" is possible ?
To what do you want to add this blacklist? Please describe the problem fully.
in our logfile we have many of the content we want blacklist with keywords
list "some test,sometext1,sometext2,"
Splunk calls that "filtering". See https://docs.splunk.com/Documentation/Splunk/8.1.3/Forwarding/Routeandfilterdatad#Filter_event_data_... and https://community.splunk.com/t5/Getting-Data-In/Filtering-events-using-NullQueue/m-p/66392
