Getting Data In

Splunk Blacklist not working on log files containing .info.

Hi Splunk community,

I have created a custom monitor that I hoped would "blacklist" and exclude from indexing all files in the referenced directory containing .INFO.

I have tested my regex expression on regex101 successfully but still the log files are indexed

Below are the monitors

disabled = 0

Below is example of a .INFO. file that I need to exclude.

Path to log files is /var/log/impalad

-rw-r--r-- 1 impala impala 57421471 Apr 12 10:09

Any feedback would be greatly appreciated


0 Karma