Hi Splunk community,
I have created a custom monitor that I hoped would "blacklist" and exclude from indexing all files in the referenced directory containing .INFO.
I have tested my regex expression on regex101 successfully but still the log files are indexed
Below are the monitors
[monitor:///var/log/impalad]
blacklist=(.INFO[.|-|\s]?)
index=tmolinux
disabled = 0
Below is example of a .INFO. file that I need to exclude.
Path to log files is /var/log/impalad
-rw-r--r-- 1 impala impala 57421471 Apr 12 10:09 impalad.prd-xxx-xx-xxx.xxx.xxx.local.impala.log.INFO.20190412-074926.20116
Any feedback would be greatly appreciated
Thanks
