topic What is the best way to blacklist, in GUI compared with inputs.conf? in Getting Data In

What is the best way to blacklist, in GUI compared with inputs.conf?

saeedb101 — Thu, 25 Jan 2018 14:26:57 GMT

We have a cluster of three indexers, a Cluster Master, a Search Head/License Master, and a Heavy forwarder. What is the best way to blacklist, or whitelist, certain classes of input data? In the Cluster Master GUI, or through the input.cnfg on the Forwarder?

Thanks,
Sid Bastani

Re: What is the best way to blacklist, in GUI compared with inputs.conf?

yannK — Tue, 29 Sep 2020 17:48:17 GMT

Can you clarify ?
"way to blacklist, or whitelist, certain classes of input data"

to block a log file, the best is to configure the inputs.conf on the forwarders, to skip the files (blacklists and strict monitor paths)
to block some windows events (wineventlog), the best is to setup eventcode or regex blacklists in inputs.conf on the windows forwarder.
otherwise, to drop events (but not all), you have to look at nullQueue filtering, and setup the filters (in props.conf and transforms.conf) on the servers parsing the logs: indexers, or heavy forwarders ( or for special indexed_extractions sourcetypes, on the forwarders) see : http://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Routeandfilterdatad#Filter_event_data_and_send_to_queues

Re: What is the best way to blacklist, in GUI compared with inputs.conf?

saeedb101 — Thu, 25 Jan 2018 18:38:04 GMT

Thank you for your answer. I am really curious to find out why it is not a good idea to use the GUI for blacklisting or whitelisting? You know, through "Server Classes", "Clients", and "Apps"? Don't we obtain the same results when we use the "Include (Whitelist)" and "Exclude (Blacklist" GUI page?

Your advice would be very much appreciated.

Re: What is the best way to blacklist, in GUI compared with inputs.conf?

yannK — Thu, 25 Jan 2018 18:48:37 GMT

I see, when you meant the GUI, you were referring to the "forwarder management/deployment server" UI.

Then yes, you can configure your inputs filters from there, as they are the ones that will be pushed to the deployment clients (i.e. the forwarders, in inputs.conf)

Remark : do not get confused between the whitelist/backlist on the inputs monitor paths, and the whitelist/blacklist on the hostnames used to apply classes to particular subset of forwarders/deploymentclients.