Getting Data In

Blacklist audit.log from inputs.conf

rickymckenzie10
Explorer

I want to block the audit.log file from a particular instance sending logs to splunk, is the stanza sufficient to accomplish that?

Per matching a file:

blacklist = <regular expression>
* If set, files from this input are NOT monitored if their path matches the
  specified regex.
* Takes precedence over the deprecated '_blacklist' setting, which functions
  the same way.
* If a file matches the regexes in both the deny list and allow list settings,
  the file is NOT monitored. Deny lists take precedence over allow lists.
* No default.
[monitor:///logs/incoming/file.com/all-messages.log]
sourcetype = something
index = something_platform
disabled = 0
blacklist = audit.log
Labels (3)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @rickymckenzie10 ,

yes it's possible to filter audit logs from some servers but your approach isn't correct:

the blacklist option is to not index files not some events from a file.

If you don't want only events read from the same file, the only solution is filter logs on Indexers before indexing ( https://docs.splunk.com/Documentation/SplunkCloud/9.2.2403/Forwarding/Routeandfilterdatad#Filter_eve... ).

In other words, filtering isn't possible on Forwarders.

The only logs that's possible to filter on Forwarders are WinEventLogs but it isn't your case.

Ciao.

Giuseppe

View solution in original post

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @rickymckenzie10 ,

yes it's possible to filter audit logs from some servers but your approach isn't correct:

the blacklist option is to not index files not some events from a file.

If you don't want only events read from the same file, the only solution is filter logs on Indexers before indexing ( https://docs.splunk.com/Documentation/SplunkCloud/9.2.2403/Forwarding/Routeandfilterdatad#Filter_eve... ).

In other words, filtering isn't possible on Forwarders.

The only logs that's possible to filter on Forwarders are WinEventLogs but it isn't your case.

Ciao.

Giuseppe

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @rickymckenzie10 ,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉

Get Updates on the Splunk Community!

Transforming Financial Data into Fraud Intelligence

Every day, banks and financial companies handle millions of transactions, logins, and customer interactions ...

How to send events & findings from AWS to Splunk using Amazon EventBridge

Amazon EventBridge is a serverless service that uses events to connect application components together, making ...

Exciting News: The AppDynamics Community Joins Splunk!

Hello Splunkers,   I’d like to introduce myself—I’m Ryan, the former AppDynamics Community Manager, and I’m ...