disabled = false
index = customer_XXXX_XXXXXXXX
blacklist = Level="(INFO)"
Unfortunately after several tries, and after making a change, restarting Splunk to see the change, then waiting several hours for the Data Inputs page to queue up the number of files, it still doesn't work.
Can anyone please shed some insight into what I'm doing wrong please?
Ultimately I'd like to do something like: