topic Re: quick clarification, difference between a inputs.conf whitelist and dorp events with Props.conf and Transfroms.conf in Getting Data In

What is the difference between a inputs.conf whitelist and dorp events with Props.conf and Transfroms.conf?

aasabatini — Mon, 16 Jan 2023 19:42:34 GMT

Hi folks,

I need a quick clarification, I need to know if I use a whitelist function on inputs.conf I will saving the license like the drop event configuration by props and transforms.

thanks in advance

Regards

Alessandro

Re: quick clarification, difference between a inputs.conf whitelist and dorp events with Props.conf and Transfroms.conf

PickleRick — Fri, 13 Jan 2023 09:02:34 GMT

Whitelists/blacklists in input definition limit filenames which are considered for ingestion. And that's all. They don't drop anything.

Re: quick clarification, difference between a inputs.conf whitelist and dorp events with Props.conf and Transfroms.conf

PaulPanther — Fri, 13 Jan 2023 09:04:37 GMT

@aasabatini Yes, you will save license because data that are not on whitelist will be ignored.

Re: quick clarification, difference between a inputs.conf whitelist and dorp events with Props.conf and Transfroms.conf

Jawahir — Sat, 14 Jan 2023 05:59:16 GMT

Both will be having the same effect, because props and transforms are part of the parsing activity only, data passes through the license after the parsing.

If you are filtering the data inputs (inputs.conf) using a whitelist or any other way at the time of reading it, you can save some network bandwidth by reducing the amount of data sent toward the Heavy Forwarder/Indexer. And also you can reduce the effort of the parser by reducing the amount of data to be parsed.

Both the case's licenses will be calculated based on the data which the parser outputs.