topic Blacklist audit.log from inputs.conf in Getting Data In

Blacklist audit.log from inputs.conf

rickymckenzie10 — Thu, 22 Aug 2024 21:34:37 GMT

I want to block the audit.log file from a particular instance sending logs to splunk, is the stanza sufficient to accomplish that?

Per matching a file:

blacklist = <regular expression>
* If set, files from this input are NOT monitored if their path matches the
  specified regex.
* Takes precedence over the deprecated '_blacklist' setting, which functions
  the same way.
* If a file matches the regexes in both the deny list and allow list settings,
  the file is NOT monitored. Deny lists take precedence over allow lists.
* No default.

[monitor:///logs/incoming/file.com/all-messages.log] sourcetype = something index = something_platform disabled = 0 blacklist = audit.log

Re: Blacklist audit.log from inputs.conf

gcusello — Fri, 23 Aug 2024 06:50:51 GMT

Hi @rickymckenzie10 ,

yes it's possible to filter audit logs from some servers but your approach isn't correct:

the blacklist option is to not index files not some events from a file.

If you don't want only events read from the same file, the only solution is filter logs on Indexers before indexing ( https://docs.splunk.com/Documentation/SplunkCloud/9.2.2403/Forwarding/Routeandfilterdatad#Filter_event_data_and_send_to_queues ).

In other words, filtering isn't possible on Forwarders.

The only logs that's possible to filter on Forwarders are WinEventLogs but it isn't your case.

Ciao.

Giuseppe

Re: Blacklist audit.log from inputs.conf

gcusello — Tue, 03 Dec 2024 16:31:37 GMT

Hi @rickymckenzie10 ,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉

Re: Blacklist audit.log from inputs.conf

rickymckenzie10 — Tue, 03 Dec 2024 16:40:28 GMT

Sure: https://community.splunk.com/t5/Getting-Data-In/Rolling-upgrade-vs-Maintenance-mode-commands-on-cluster-manager/td-p/705861 🙂