Getting Data In

Splunk Blacklist not working on log files containing .info.

rorymcdonald060
Engager

Hi Splunk community,

I have created a custom monitor that I hoped would "blacklist" and exclude from indexing all files in the referenced directory containing .INFO.

I have tested my regex expression on regex101 successfully but still the log files are indexed

Below are the monitors

[monitor:///var/log/impalad]
blacklist=(.INFO[.|-|\s]?)
index=tmolinux
disabled = 0

Below is example of a .INFO. file that I need to exclude.

Path to log files is /var/log/impalad

-rw-r--r-- 1 impala impala 57421471 Apr 12 10:09 impalad.prd-xxx-xx-xxx.xxx.xxx.local.impala.log.INFO.20190412-074926.20116

Any feedback would be greatly appreciated

Thanks

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...