topic Re: How to Blacklist a Forwarder in Getting Data In

How to blacklist a forwarder?

mad4wknds — Wed, 22 Mar 2023 15:34:55 GMT

I have a 250 forwarders in my environment. I have one server that no one can reach a solution on due to low priority. The box is killing my indexer with storage errors. I have no control over uninstalling the forwarder.

I would like to blacklist this forwarder. Is this something that can be done and how?

Re: How to Blacklist a Forwarder

lukejadamec — Fri, 07 Feb 2014 00:32:39 GMT

What version of splunk on the indexer?

Re: How to Blacklist a Forwarder

kristian_kolb — Fri, 07 Feb 2014 00:38:10 GMT

One thing that you can do immediately is to set up a regex transform on your indexer to remove the unwanted data. The example below will re-route all data from that host to the trash can.

props.conf

[host::your_host]
TRANSFORMS-remove_stuff = setnull

transforms.conf

[setnull]
REGEX = .
DEST_KEY = queue
FORMAT = nullQueue

NB: you can make a more selective filtering by writing a more specific regex, so that you actually get to keep those events that you like.

Re: How to Blacklist a Forwarder

lukejadamec — Fri, 07 Feb 2014 00:40:01 GMT

You could try something like this. I'm pretty sure it will also drop _internal logs because it is filtering by host. Put these stanzas in the files on the indexer in splunk\etc\system\local, and restart Splunk. This will only affect new events.

props.conf

[host::hostname]
TRANSFORMS-drop = drop_event
transforms.conf

transforms.conf

[drop_event]
REGEX = .
DEST_KEY = queue
FORMAT = nullQueue

Re: How to Blacklist a Forwarder

mad4wknds — Fri, 07 Feb 2014 16:29:54 GMT

Works great for the "Queue" but I need a total blackout meaning that it is still and blocking other queues.

Thanks for the response.

Re: How to Blacklist a Forwarder

lukejadamec — Fri, 07 Feb 2014 16:56:41 GMT

Not sure I understand. This should drop everything from the host. What is still getting indexed?

Re: How to Blacklist a Forwarder

kristian_kolb — Fri, 07 Feb 2014 16:57:17 GMT

Then I would really suggest fw rule, preferably on the network, but local will also work. Perhaps you should also look at the

acceptFrom = <network_acl>

setting in inputs.conf where you define the forwarder connections (splunktcp:9997, or whatever port you're already listening to). From the docs on inputs.conf:

Entries can also be prefixed with '!' to cause the rule to reject the connection. Rules are applied in order, and the first one to match is used. For example, "!10.1/16, *" will allow connections from everywhere except the 10.1.*.* network.

Re: How to Blacklist a Forwarder

kristian_kolb — Fri, 07 Feb 2014 16:59:36 GMT

lukejadamec, well, regex transforms take place after linebreaking, timestamping etc, so if there is really a lot of crap coming from the evil forwarder, it could affect the event processing... I guess.

Re: How to Blacklist a Forwarder

mad4wknds — Fri, 07 Feb 2014 17:09:12 GMT

Thank you kristian.kolb the "acceptFrom" is the answer I was really looking for.

Thanks again

Re: How to Blacklist a Forwarder

martin_mueller — Fri, 07 Feb 2014 17:12:09 GMT

You could deny all incoming connections from that host like this:

iptables -A INPUT -s 1.2.3.4 -j DROP

That's fairly invasive though, talk to your system or network administrators first.

Re: How to Blacklist a Forwarder

teedilo — Wed, 04 Mar 2015 17:02:42 GMT

Kristian -- I just wanted to thank you for your suggestion to use acceptFrom in inputs.conf. It was the only thing that finally worked for me to shut down traffic from some "rogue" forwarders. Sending things to nullQueue via props.conf and transforms.conf has worked for me for other things, but I couldn't find any combination that would work for this. Thanks again.

Re: How to Blacklist a Forwarder

Tinza — Wed, 22 Mar 2023 14:56:02 GMT

Hi @kristian_kolb, If I create this in a specific app called e.g twistlock_parsing to remove events coming from host 127.0.0.1 only within a specific index e.g azure_twistlock - will this drop all events across all indexes containing that ip? I only want that IP address dropped in index azure_twistlock. I have already tried the solution from this page: https://community.splunk.com/t5/Getting-Data-In/How-to-blacklist-a-host-hosts-is-sending-logs-to-Splunk-via-TCP/m-p/289283 and it didn't work