https://community.splunk.com/t5/Getting-Data-In/How-to-Blacklist-on-a-Universal-Forwarder-with-a-TCP-input/m-p/415582#M73471 <P>Thank You, they can whitelist but not black list or that is what they told us.</P> <P>Thank You!</P> Mon, 20 Aug 2018 13:24:39 GMT pfabrizi 2018-08-20T13:24:39Z https://community.splunk.com/t5/Getting-Data-In/How-to-Blacklist-on-a-Universal-Forwarder-with-a-TCP-input/m-p/415580#M73469 <P>I have a UF running on a linux device, with a TCP input. The input is coming from a Graylog forwarder and all the windows events coming with a 'winlogbeat_ preface.</P> <P>I want to black list windows events coming by event code and normally I use a blacklist -= EventCode="xxxx" Message=....</P> <P>however the eventcode comes in as winlogbeat_event_id, <BR /> I did try this:<BR /> blacklist1= winlogbeat_event_id = "4662"</P> <P>This doesn't appear to work. </P> <P>Can someone help with this?</P> <P>Is there any log that shows events being whitelisted or blacklisted?</P> <P>Thank You!</P> Tue, 29 Sep 2020 20:57:22 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-Blacklist-on-a-Universal-Forwarder-with-a-TCP-input/m-p/415580#M73469 pfabrizi 2020-09-29T20:57:22Z https://community.splunk.com/t5/Getting-Data-In/How-to-Blacklist-on-a-Universal-Forwarder-with-a-TCP-input/m-p/415581#M73470 <P>TCP inputs cannot be filtered with blacklists like that. That only works for WinEventLog inputs.</P> <P>Perhaps that Graylog forwarder you use can perform some filtering? Otherwise you would have to look at dropping the unwanted events at your Indexers, by routing them to the nullqueue: <A href="http://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Routeandfilterdatad#Discard_specific_events_and_keep_the_rest">http://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Routeandfilterdatad#Discard_specific_events_and_keep_the_rest</A></P> Mon, 20 Aug 2018 13:17:51 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-Blacklist-on-a-Universal-Forwarder-with-a-TCP-input/m-p/415581#M73470 FrankVl 2018-08-20T13:17:51Z https://community.splunk.com/t5/Getting-Data-In/How-to-Blacklist-on-a-Universal-Forwarder-with-a-TCP-input/m-p/415582#M73471 <P>Thank You, they can whitelist but not black list or that is what they told us.</P> <P>Thank You!</P> Mon, 20 Aug 2018 13:24:39 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-Blacklist-on-a-Universal-Forwarder-with-a-TCP-input/m-p/415582#M73471 pfabrizi 2018-08-20T13:24:39Z https://community.splunk.com/t5/Getting-Data-In/How-to-Blacklist-on-a-Universal-Forwarder-with-a-TCP-input/m-p/415583#M73472 <P><CODE>whitelist = foo</CODE> also doesn't work on a UF TCP input.</P> Mon, 20 Aug 2018 13:32:55 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-Blacklist-on-a-Universal-Forwarder-with-a-TCP-input/m-p/415583#M73472 FrankVl 2018-08-20T13:32:55Z