topic Re: Blacklisting path of inputs.conf for Local Test in Getting Data In

Blacklisting path of inputs.conf for Local Test

smith_ — Tue, 21 Nov 2023 00:22:56 GMT

Hello,

I'm aiming to test event blacklists on my host system locally, but I'm uncertain about the correct location within the inputs.conf file to place these blacklists. Would it be in:

C:\Program Files\SplunkUniversalForwarder\etc\system\local\inputs.conf
C:\Program Files\SplunkUniversalForwarder\etc\apps\myapp\local\inputs.conf

Thanks...

Re: Blacklisting path of inputs.conf for Local Test

inventsekar — Tue, 21 Nov 2023 01:37:56 GMT

Hi @smith_

Both locations are right.

the first one ... the \etc\system\local\inputs.conf is the default inputs.conf file path. Generally if you dont have different apps, you can use this file alone and specify all files for monitoring, whitelisting and blacklistings.

if you have lots of things for monitoring, it will be better to group them as "apps" and then have their config files in their particular folders. so troubleshooting will become easy.

then understanding the file precedence

http://docs.splunk.com/Documentation/Splunk/9.1.1/Admin/Wheretofindtheconfigurationfiles

Re: Blacklisting path of inputs.conf for Local Test

smith_ — Wed, 06 Dec 2023 13:06:39 GMT

@inventsekar , I believe this is the cause of issue,

from the below snapshot Creator_Process_Name New_Process_Name

C:\Program Files (x86)\Tanium\Tanium Client\TaniumClient.exe

C:\Windows\System32\cmd.exe

When I excluded the creator processname tanium its newprocess name cmd.exe is also excluded.