Unable to use Whitelist and Blacklist in splunk

[luv]

Hi
For whitelist:-
I have following logs under my 😧 directory
D:/logs/abcUSEFUL.log
D:/logs/xyzUSEFUL.log
D:/logs/abcWASTE.log
D:/logs/xyzWASTE.log

I want to forward the log files that contains "USEFUL" in between their names
like from the above files only "abcUSEFUL.log" & "xyzUSEFUL.log" should be able to make their way into the indexer rest should be stopped.
following is the stanza which i am using for my inputs.conf but it doesn't seem to work

[monitor://D:\logs\*.log]
disabled = false
followTail =0
sourcetype = test
whitelist = USEFUL\.log$

For Blacklist:-
Suppose If i want to restrict the files which have "WASTE" in between their name then they should not get forwarded without affecting the forwarding of other files under the same directory.

Any advice?

Thanks 🙂

[lukejadamec · Accepted solution]

Try being less specific with your monitor and then whitlisting and blacklisting the text in the filename:

[monitor://D:\logs]
blacklist=waste
whitelist=useful
disabled = false
followTail =0
sourcetype = test

[lukejadamec]

Yes, regex works in whitelists and blacklists.

[luv]

Thanks lukejadamec that worked! 🙂

simple regular expressions would also work in blacklist & whitelist right?

for files "ilol.log" and "ilol2.log" i want both of them to be forwarded means whichever file contains "lol" keyword
But following stanza is not working only 1st one (ilol.log) is getting forwarded not "ilol2.log"

[monitor://D:\logs]
disabled = false
followTail = 0
sourcetype = lol
whitelist = lol*\.log$