Blacklist event id from splunk server itself

[rriis]

I figured out how to add blacklisting in for forwarders (deployed apps), but where is this configured on the splunk server itself?  This is version 7.2.9.1.  The splunk server is windows.  I though it could be d:\program files\splunk\etc\system\local\inputs.conf, but that file looks very different than the one that is deployed to forwarders.

[richgalloway]

Which form of blacklisting do you want?  Blacklisting of files is configured in inputs.conf on the forwarder whereas blacklisting of events is configured in props.conf and transforms.conf on the indexers.

Inputs.conf on the server is expected to be very different from the one on the forwarder.

[rriis]

Thanks for the reply, I would like to blacklist a security event that is coming from the splunk server (itself).  The main splunk database server is logging a particular event id that is useless and filling up an index.  I would like to blacklist that event.  I know the syntax for blacklisting, just not sure how (or where) to configure this for the splunk main server.  thanks in advance

[richgalloway]

That would done on the indexers using props and transforms.

Have you looked at the cause(s) of those events?  Perhaps a simple change can prevent them from being generated in the first place.  What is the event?

[rriis]

event 4663, removable storage.  The process information shows the process name to be d:\program files\splunk\bin\splunkd.exe

Seems like anytime splunk fires off that process it logs a 4663 event.  The D drive is not a removable media device but is just a second disk in the system (vmdk)

[richgalloway]

Ah, a Windows event.  I thought you were dealing with an event generated by Splunk itself.  In this case, you can filter out that event in inputs.conf.  See "Event Log Filtering" in the Admin manual (https://docs.splunk.com/Documentation/Splunk/8.2.0/Admin/Inputsconf#Event_Log_filtering).