topic Re: Manage UF blacklist and whitelist with DS in Splunk Cloud Platform

How to manage UF blacklist and whitelist with DS?

SplunkExplorer — Wed, 02 Aug 2023 19:24:58 GMT

Hi Splunkers (I know, you starts to see my post too much on this blog...sorry!), I'm a bit confused about the management of blacklist and whitelist mechanism, for universal forwarders.

As I wrote on others posts, we are managing a Splunk Cloud for a customer where we are completing, for Windows logs, the migration from WMI to UF. After installation completed, we want to manage those UF with a DS. Reading docs, I got that first step to say a Splunk host "Hey, you are a DS!" is to create the first app to be deployed on clients.
Here the example states about outputs.conf but, due we already linked UFs to our HF, we don't need that; we prefer to use the inputs.conf, cause we want manage blacklist and whitelist mechanism true DS.

The confusing thing for me is: is I want to say to UF "Hey, collect only a subset of Windows Event Code ", I saw here on community some posts where people get struck with whitelist and its wa suggested to them to us bot parameters: whitelist and blacklist. What I don't understand is why this and, so, the final configuration.

For Example, if I want to say on inputs.conf for Security logs "Hey, collect only 4624 and 4625" I will have something like that:

[WinEventLog://Security]
...
<other parameter>

...

whitelist = ?
blacklist=?