Blacklist audit.log from inputs.conf

[rickymckenzie10]

I want to block the audit.log file from a particular instance sending logs to splunk, is the stanza sufficient to accomplish that?

Per matching a file:

blacklist = <regular expression>
* If set, files from this input are NOT monitored if their path matches the
  specified regex.
* Takes precedence over the deprecated '_blacklist' setting, which functions
  the same way.
* If a file matches the regexes in both the deny list and allow list settings,
  the file is NOT monitored. Deny lists take precedence over allow lists.
* No default.

[monitor:///logs/incoming/file.com/all-messages.log]
sourcetype = something
index = something_platform
disabled = 0
blacklist = audit.log

[gcusello · Accepted solution]

Hi @rickymckenzie10 ,

yes it's possible to filter audit logs from some servers but your approach isn't correct:

the blacklist option is to not index files not some events from a file.

If you don't want only events read from the same file, the only solution is filter logs on Indexers before indexing ( https://docs.splunk.com/Documentation/SplunkCloud/9.2.2403/Forwarding/Routeandfilterdatad#Filter_eve... ).

In other words, filtering isn't possible on Forwarders.

The only logs that's possible to filter on Forwarders are WinEventLogs but it isn't your case.

Ciao.

Giuseppe

[gcusello]

Hi @rickymckenzie10 ,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉

[rickymckenzie10]

Sure: https://community.splunk.com/t5/Getting-Data-In/Rolling-upgrade-vs-Maintenance-mode-commands-on-clus... 🙂