topic Re: How to configure inputs.conf to blacklist Windows Event Logs on indexer? in Getting Data In

How to configure inputs.conf to blacklist Windows Event Logs on indexer?

kpavan — Mon, 28 Sep 2020 17:32:26 GMT

Hi,

I below is the inputs.conf which i have configured on my indexer, but it is not blocking anything. is this is correct format or not. I need to block it on indexer level since i have more forwarders. Please let me know the correct configuration.

[WinEventLog://Application]
disabled = 1
start_from = newest
evt_resolve_ad_obj = 1
checkpointInterval = 5
blacklist = *

Thanks!

Re: How to configure inputs.conf to blacklist Windows Event Logs on indexer?

kpavan — Mon, 28 Sep 2020 17:32:29 GMT

i did configured the same on UF inputs.conf it is blocking, but when i applied on indexer it is not

[WinEventLog://System]
disabled = 0
start_from = newest
evt_resolve_ad_obj = 1
checkpointInterval = 5
blacklist = 7036

Re: How to configure inputs.conf to blacklist Windows Event Logs on indexer?

ppablo — Wed, 10 Sep 2014 08:21:04 GMT

Hi @kpavan

From this blog post on filtering Windows Event Logs with blacklist, it seems like you can only filter with inputs.conf on the forwarder.

http://blogs.splunk.com/2013/10/14/windows-event-logs-in-splunk-6/

The author mentions in the comment thread that they do have an earlier blog post on filtering at the indexer level, but I didn't have any luck finding that post specific to what you're looking for. If this doesn't resolve your issue, hopefully a configuration expert on filtering can chime in.

Re: How to configure inputs.conf to blacklist Windows Event Logs on indexer?

kpavan — Wed, 10 Sep 2014 09:11:56 GMT

Thanks for your quick response!

Actually it did worked in UF. Since I have too many UF's, so i would like to filter on indexer level.

Re: How to configure inputs.conf to blacklist Windows Event Logs on indexer?

MuS — Wed, 10 Sep 2014 09:16:45 GMT

If you want it to be filtered on the indexer follow this docs about Filter event data and send to queues. This way you can nullQueue unneeded events.

Re: How to configure inputs.conf to blacklist Windows Event Logs on indexer?

kpavan — Wed, 10 Sep 2014 11:27:00 GMT

is there a way to block the specific host/ip which sending entire logs on indexer.

Re: How to configure inputs.conf to blacklist Windows Event Logs on indexer?

ITICSNORTH — Fri, 21 Nov 2014 15:20:26 GMT

even it's not working on UF to 😞