topic How to blacklist a Universal Forwarder? in Getting Data In

How to blacklist a Universal Forwarder?

ccsfdave — Mon, 06 Jun 2016 14:01:16 GMT

This should be relatively simple, but I cannot find discussion or documentation on it. I suspect that Splunk assumes if a universal forwarder is installed, the data is wanted. The problem is that there is a UF out of my control with a misconfigured index name. I would like to blacklist it until the owner can fix it.

How would I blacklist a UF?

Re: How to blacklist a Universal Forwarder?

jkat54 — Mon, 06 Jun 2016 14:48:12 GMT

Do you control the UF from your deployment server? If not you should.

Your options are blocking the src_ip at the firewall... (iptables on linux, windows firewall will do the trick too)

Asking UF owner to turn off UF.

IF you have UF password you can probably disable via REST calls.

Re: How to blacklist a Universal Forwarder?

ccsfdave — Mon, 06 Jun 2016 14:52:34 GMT

Well, I let the question stand because I figured some good discussion or tips may come from it but it was in my DS so I took care of it (i think) from there.

Re: How to blacklist a Universal Forwarder?

jkat54 — Mon, 06 Jun 2016 15:17:34 GMT

I assume splunk doesn't want you to blacklist forwarders because they should be controlled via the DS. And if you had a config file somewhere blacklisting them you might spend days trying to figure out why they arent sending data in, etc.

Re: How to blacklist a Universal Forwarder?

ccsfdave — Mon, 06 Jun 2016 15:41:10 GMT

Yeah, that makes sense

Re: How to blacklist a Universal Forwarder?

woodcock — Mon, 06 Jun 2016 15:44:45 GMT

Like this:

1: In props.conf, set the TRANSFORMS-null attribute:

[host::BadUniversalForwarderHostIdentifierHere]
TRANSFORMS-null = TrashEverything

2: Create a corresponding stanza in transforms.conf. Set DEST_KEY to queue and FORMATto nullQueue:

[TrashEverything]
REGEX = .
DEST_KEY = queue
FORMAT = nullQueue

3: Deploy to all Indexers and restart all Splunk instances there.

Re: How to blacklist a Universal Forwarder?

jkat54 — Mon, 06 Jun 2016 15:47:42 GMT

Yeah this is great option if you can restart indexers. The "blacklisting" word put me in a different direction, but nullQueueing is in effect the same. Thanks woodcock!

Re: How to blacklist a Universal Forwarder?

ccsfdave — Mon, 06 Jun 2016 16:00:34 GMT

Yeah, I have full control of the central Splunk Infrastructure: SH, Indexers, HF, DS. So, Let me accept this and will update the answer if I need to in the future.