Splunk Search

Unable to blacklist multiple patterns using "|" in inputs.conf ?

pimco_rgoyal
Observer

I have used the below configuration as part of my inputs.conf but am unable to blacklist the logs that end with client.log and server.log using this. For now I had to explicitly add "blacklist = .server.log$" to blacklist them. Any changes needed to fix and get this working here ?

0 Karma
1 Solution

DalJeanis
Legend

1) I'm seeing spaces between the | and the terms beside it. That would cause issues.
2) Remember that a . matches anything, so it you mean only the character., then you need to escape it like this - \. .
3) Parenthesis are not necessary in this context, when you are providing alternates for the entire pattern. They are useful if you want to give alternatives for a small part of a pattern.
4) If the file names may be case sensitive, then (i) at the front of the pattern can make the regular expression case-insensitive.

So, if the individual blacklist lines worked and were not case sensitive, then either of these should work...

\.client\.log$|\.server\.log$

...or ...

\.(client|server)\.log$

View solution in original post

0 Karma

DalJeanis
Legend

1) I'm seeing spaces between the | and the terms beside it. That would cause issues.
2) Remember that a . matches anything, so it you mean only the character., then you need to escape it like this - \. .
3) Parenthesis are not necessary in this context, when you are providing alternates for the entire pattern. They are useful if you want to give alternatives for a small part of a pattern.
4) If the file names may be case sensitive, then (i) at the front of the pattern can make the regular expression case-insensitive.

So, if the individual blacklist lines worked and were not case sensitive, then either of these should work...

\.client\.log$|\.server\.log$

...or ...

\.(client|server)\.log$
0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...