Getting Data In

Blacklist audit.log from inputs.conf

rickymckenzie10
Explorer

I want to block the audit.log file from a particular instance sending logs to splunk, is the stanza sufficient to accomplish that?

Per matching a file:

blacklist = <regular expression>
* If set, files from this input are NOT monitored if their path matches the
  specified regex.
* Takes precedence over the deprecated '_blacklist' setting, which functions
  the same way.
* If a file matches the regexes in both the deny list and allow list settings,
  the file is NOT monitored. Deny lists take precedence over allow lists.
* No default.
[monitor:///logs/incoming/file.com/all-messages.log]
sourcetype = something
index = something_platform
disabled = 0
blacklist = audit.log
Labels (3)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @rickymckenzie10 ,

yes it's possible to filter audit logs from some servers but your approach isn't correct:

the blacklist option is to not index files not some events from a file.

If you don't want only events read from the same file, the only solution is filter logs on Indexers before indexing ( https://docs.splunk.com/Documentation/SplunkCloud/9.2.2403/Forwarding/Routeandfilterdatad#Filter_eve... ).

In other words, filtering isn't possible on Forwarders.

The only logs that's possible to filter on Forwarders are WinEventLogs but it isn't your case.

Ciao.

Giuseppe

View solution in original post

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @rickymckenzie10 ,

yes it's possible to filter audit logs from some servers but your approach isn't correct:

the blacklist option is to not index files not some events from a file.

If you don't want only events read from the same file, the only solution is filter logs on Indexers before indexing ( https://docs.splunk.com/Documentation/SplunkCloud/9.2.2403/Forwarding/Routeandfilterdatad#Filter_eve... ).

In other words, filtering isn't possible on Forwarders.

The only logs that's possible to filter on Forwarders are WinEventLogs but it isn't your case.

Ciao.

Giuseppe

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @rickymckenzie10 ,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉

Get Updates on the Splunk Community!

Splunk App Dev Community Updates – What’s New and What’s Next

Welcome to your go-to roundup of everything happening in the Splunk App Dev Community! Whether you're building ...

The Latest Cisco Integrations With Splunk Platform!

Join us for an exciting tech talk where we’ll explore the latest integrations in Cisco &#43; Splunk! We’ve ...

Enterprise Security Content Update (ESCU) | New Releases

In April, the Splunk Threat Research Team had 2 releases of new security content via the Enterprise Security ...