Splunk Search

blacklist not working * condition

puneethgowda
Communicator

sourcetype=XyzProd
blacklist = MethodExecutionInfo(\d{8})-(\d{2}).txt|DebugInfo(\d{8})-(\d{2}).txt|CacheRefreshInfo(\d{8})-(\d{2}).txt

I want to add below one

|currency(\d{8})-(\d{2}).txt
It's not working

Tags (1)
0 Karma

puneethgowda
Communicator

(MethodExecutionInfo|DebugInfo|CacheRefreshInfo|.currency.)((\d{8})-(\d{2})).txt

Got the answer from slack

0 Karma
Get Updates on the Splunk Community!

New Year, New Changes for Splunk Certifications

As we embrace a new year, we’re making a small but important update to the Splunk Certification ...

Stay Connected: Your Guide to January Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...

[Puzzles] Solve, Learn, Repeat: Reprocessing XML into Fixed-Length Events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...