topic Re: Parameter "blacklist" in inputs.conf in Getting Data In

Parameter "blacklist" in inputs.conf

templier — Wed, 22 Jan 2014 12:51:26 GMT

Hello, friends!

We have:
Splunk server (indexer) and computer with WinXP and UniversalForwarder.
The task was to remove some windows security events from Splunk indexer.
It was solved by using the parameter "blacklist" in inputs.conf on computer with WinXP.

inputs.conf

[WinEventLog://Security] disabled = false blacklist = 538,540

And all that is needed work, the data came from the EventLog except the two specified ID (538 and 540).

The problem started when I decided to add a third ID (576).
I change the inputs.conf:

[WinEventLog://Security] disabled = false blacklist = 538,540,576

Save, restart splunk service.

And any event from the EventLog from this machine stopped coming to indexer.
If i change inputs.conf to original appearance (when two of Event) - all working again as necessary.

What can be caused by this problem?

Thx!

Re: Parameter "blacklist" in inputs.conf

laserval — Wed, 22 Jan 2014 13:00:44 GMT

Do you get other events from the forwarder? Can you see any errors or warnings from the forwarder when searching in index=_internal?

Re: Parameter "blacklist" in inputs.conf

templier — Wed, 22 Jan 2014 13:17:29 GMT

Yes, other data from this machine come correct. Disappears only EventLog.

Re: Parameter "blacklist" in inputs.conf

somesoni2 — Wed, 22 Jan 2014 18:58:42 GMT

Just to be sure, can you try changing the order of event ids in blacklist?

Re: Parameter "blacklist" in inputs.conf

templier — Thu, 23 Jan 2014 06:17:40 GMT

blacklist = 576,538,540 and blacklist = 576,538 - the same result 😞
As an option to make the whitelist with all EventID Except for these ID, but will try it later. I think this can not be caused by the free license.

Re: Parameter "blacklist" in inputs.conf

Pierceyuk — Wed, 12 Mar 2014 10:24:06 GMT

Have you checked the event log to see if there are events not with those ID's? just want to rule out the obvious etc...

Re: Parameter "blacklist" in inputs.conf

templier — Wed, 12 Mar 2014 12:13:17 GMT

Of course I checked a security log for the presence of this ID's. In security log entry is present, they are not present in splunk.

Re: Parameter "blacklist" in inputs.conf

rakesh_498115 — Wed, 12 Mar 2014 12:15:40 GMT

have u tried blacklist =(576|538|540)

Re: Parameter "blacklist" in inputs.conf

bshuler_splunk — Wed, 12 Mar 2014 13:04:48 GMT

The blacklist parameter is a regular expression:

http://regexone.com

This worked in my test:

blacklist = 538|540|576

Here is the documentation for the parameter:

http://docs.splunk.com/Documentation/Splunk/latest/admin/Inputsconf

Re: Parameter "blacklist" in inputs.conf

templier — Mon, 31 Mar 2014 13:19:55 GMT

Thx. Сheck shortly.
The last time was not the time to do it