Hi karthi2809,
sorry but your request isn't so clear: what do you mean with "blacklist .2017-04-03.log "?
I can think that in /app/mpi/deployment/logs/ folder you have many files named smart.log.YYYY-MM-DD.log
and other file names, so you want all the other files but not smart.log.YYYY-MM-DD.log, correct?
if this is your need, you can follow two ways:
if the names of the whitelist files are few, you can whiteliste them so you have more control on your input ohase, if otherwise you have to take many files but not smart.log.YYYY-MM-DD.log, you can blacklist these files inserting in your inputs.conf stanza
[blacklist:<path>]
* Protect files on the file system from being indexed or previewed.
* The input treats a file as blacklisted if the file starts with any of the defined blacklisted <paths>.
* The preview endpoint will return and error when asked to preview a blacklisted file.
* The oneshot endpoint and command will also return an error.
* When a blacklisted file is monitored (monitor:// or batch://), filestatus endpoint will show an error.
* For fschange with the 'sendFullEvent' option enabled, contents of blacklisted files will not be indexed.
see http://docs.splunk.com/Documentation/Splunk/6.5.2/admin/Inputsconf.
Bye.
Giuseppe
