Splunk Search

Unable to blacklist multiple patterns using "|" in inputs.conf ?

pimco_rgoyal
Observer

I have used the below configuration as part of my inputs.conf but am unable to blacklist the logs that end with client.log and server.log using this. For now I had to explicitly add "blacklist = .server.log$" to blacklist them. Any changes needed to fix and get this working here ?

0 Karma
1 Solution

DalJeanis
SplunkTrust
SplunkTrust

1) I'm seeing spaces between the | and the terms beside it. That would cause issues.
2) Remember that a . matches anything, so it you mean only the character., then you need to escape it like this - \. .
3) Parenthesis are not necessary in this context, when you are providing alternates for the entire pattern. They are useful if you want to give alternatives for a small part of a pattern.
4) If the file names may be case sensitive, then (i) at the front of the pattern can make the regular expression case-insensitive.

So, if the individual blacklist lines worked and were not case sensitive, then either of these should work...

\.client\.log$|\.server\.log$

...or ...

\.(client|server)\.log$

View solution in original post

0 Karma

DalJeanis
SplunkTrust
SplunkTrust

1) I'm seeing spaces between the | and the terms beside it. That would cause issues.
2) Remember that a . matches anything, so it you mean only the character., then you need to escape it like this - \. .
3) Parenthesis are not necessary in this context, when you are providing alternates for the entire pattern. They are useful if you want to give alternatives for a small part of a pattern.
4) If the file names may be case sensitive, then (i) at the front of the pattern can make the regular expression case-insensitive.

So, if the individual blacklist lines worked and were not case sensitive, then either of these should work...

\.client\.log$|\.server\.log$

...or ...

\.(client|server)\.log$
0 Karma
Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...