topic Re: remove whitelist restrictions? in Getting Data In

remove whitelist restrictions?

caseynordell — Wed, 26 Jul 2017 16:31:52 GMT

I had been using an inputs.conf whitelist to filter event logs by event code but now I would like to send all security logs to splunk from the forwarder. Is simply removing the whitelist entry and restarting the splunk forwarder service enough to do this? i tried this, and it hasn't started sending the data yet, it seems...

before:

[default]
host = <Computer’s Name>
index = <index name>

[WinEventLog://Security]
disabled = 0
whitelist=528,538,540,551,4624,4634,4647,4648,4800,4801 
index = <index name>

after:

[default]
host = <Computer’s Name>
index = <index name>

[WinEventLog://Security]
disabled = 0
index = <index name>

Re: remove whitelist restrictions?

woodcock — Wed, 26 Jul 2017 17:01:03 GMT

You need to restart the Splunk service after this change for the forwarder to reload and act on this update. That should do it but it is not retroactive (only events which happen after the restart will come in).

Re: remove whitelist restrictions?

caseynordell — Wed, 26 Jul 2017 18:00:47 GMT

thank you so much. out of curiosity, is there any method to making it apply retroactively?

Re: remove whitelist restrictions?

woodcock — Tue, 29 Sep 2020 15:05:04 GMT

If you add these 2 settings and then restart:

start_from = oldest
current_only = 0
Then it should send EVERYTHING again which will cause you to have some events twice so you might use clean eventdata to delete your index data first. BUT REMEMBER TO REMOVE THESE SETTINGS after the forwarder starts sending data for "now".