topic Re: How to blacklist the logs to stop ingesting into splunk. in Getting Data In

How to blacklist the logs to stop ingesting into splunk.

smith_ — Fri, 29 Sep 2023 06:58:59 GMT

Hi,

I had blacklisted C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe in inputs.conf of Deploymentserver.

blacklist3 = EvenCode="4688" Message="(?:New Process Name:).+(?:SplunkUniversalForwarder\\bin\\splunk.exe)
Still I can see the logs ingestion into splunk, How we can stop this ingestion.

Re: How to blacklist the logs to stop ingesting into splunk.

gcusello — Fri, 29 Sep 2023 07:18:26 GMT

Hi @smith_,

I suppose that you modified the inputs.conf in the Add-On (located in $SPLUNK_HOME/etc/deployment-apps) that is deployed using the Deployment Server, is it correct?

To be more sure, check if the regex you used is correct in the search dashboard.

Ciao.

Giuseppe

Re: How to blacklist the logs to stop ingesting into splunk.

smith_ — Fri, 29 Sep 2023 09:48:09 GMT

Hi, @gcusello ,

yes I've modified the inputs.conf in the Add-On (located in $SPLUNK_HOME/etc/deployment-apps) that is deployed using the Deployment Server.

When I try this in search head it is not giving any results , Do we need to modify spl ?
index=winsec host=xxx
| regex "(?:New Process Name:).+(?:SplunkUniversalForwarder\\bin\\splunk.exe)"

Thanks

Re: How to blacklist the logs to stop ingesting into splunk.

gcusello — Fri, 29 Sep 2023 10:18:50 GMT

Hi @smith_,

if you don't have results to the control search and you have all the other logs, you solved your issue.

Ciao.

Giuseppe