Getting Data In

Blacklist audit.log from inputs.conf

rickymckenzie10
Explorer

I want to block the audit.log file from a particular instance sending logs to splunk, is the stanza sufficient to accomplish that?

Per matching a file:

blacklist = <regular expression>
* If set, files from this input are NOT monitored if their path matches the
  specified regex.
* Takes precedence over the deprecated '_blacklist' setting, which functions
  the same way.
* If a file matches the regexes in both the deny list and allow list settings,
  the file is NOT monitored. Deny lists take precedence over allow lists.
* No default.
[monitor:///logs/incoming/file.com/all-messages.log]
sourcetype = something
index = something_platform
disabled = 0
blacklist = audit.log
Labels (3)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @rickymckenzie10 ,

yes it's possible to filter audit logs from some servers but your approach isn't correct:

the blacklist option is to not index files not some events from a file.

If you don't want only events read from the same file, the only solution is filter logs on Indexers before indexing ( https://docs.splunk.com/Documentation/SplunkCloud/9.2.2403/Forwarding/Routeandfilterdatad#Filter_eve... ).

In other words, filtering isn't possible on Forwarders.

The only logs that's possible to filter on Forwarders are WinEventLogs but it isn't your case.

Ciao.

Giuseppe

View solution in original post

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @rickymckenzie10 ,

yes it's possible to filter audit logs from some servers but your approach isn't correct:

the blacklist option is to not index files not some events from a file.

If you don't want only events read from the same file, the only solution is filter logs on Indexers before indexing ( https://docs.splunk.com/Documentation/SplunkCloud/9.2.2403/Forwarding/Routeandfilterdatad#Filter_eve... ).

In other words, filtering isn't possible on Forwarders.

The only logs that's possible to filter on Forwarders are WinEventLogs but it isn't your case.

Ciao.

Giuseppe

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @rickymckenzie10 ,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉

Get Updates on the Splunk Community!

Say goodbye to manually analyzing phishing and malware threats with Splunk Attack ...

In today’s evolving threat landscape, we understand you’re constantly bombarded with phishing and malware ...

AppDynamics is now part of Splunk Ideas

Hello Splunkers, We have exciting news for you! AppDynamics has been added to the Splunk Ideas Portal. Which ...

Advanced Splunk Data Management Strategies

Join us on Wednesday, May 14, 2025, at 11 AM PDT / 2 PM EDT for an exclusive Tech Talk that delves into ...