Quantcast
Channel: Latest Questions on Splunk Answers
Viewing all articles
Browse latest Browse all 13053

fschange blacklist filter not working as expected

$
0
0

Starting at the parent directory, I have been gradually adding subdirectories to an fschange filter. Once I get to a certain point, it doesn't seem to work properly for sub directories and files anymore. An example of what I am referring to is below...

regex1 = /parent/dir.4.3.3.AB/child1/ regex2 = /parent/dir.4.3.3.AB/child2/

I started with he parent and didn't have any hits until I reached the level that is stated above. Once there I was getting hits for everything under the child1 and child2 subdirectories. This is a blacklist filter and seems to work properly until I get to that point. Is there something about my syntax or wildcards that could be causing the issue?


Viewing all articles
Browse latest Browse all 13053

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>