Splunk Blacklist not working on log files containing .info.

[rorymcdonald060]

Hi Splunk community,

I have created a custom monitor that I hoped would "blacklist" and exclude from indexing all files in the referenced directory containing .INFO.

I have tested my regex expression on regex101 successfully but still the log files are indexed

Below are the monitors

[monitor:///var/log/impalad]
blacklist=(.INFO[.|-|\s]?)
index=tmolinux
disabled = 0

Below is example of a .INFO. file that I need to exclude.

Path to log files is /var/log/impalad

-rw-r--r-- 1 impala impala 57421471 Apr 12 10:09 impalad.prd-xxx-xx-xxx.xxx.xxx.local.impala.log.INFO.20190412-074926.20116

Any feedback would be greatly appreciated

Thanks