Blacklisting path of inputs.conf for Local Test

[AL3Z]

Hello,

I'm aiming to test event blacklists on my host system locally, but I'm uncertain about the correct location within the inputs.conf file to place these blacklists. Would it be in:

1. C:\Program Files\SplunkUniversalForwarder\etc\system\local\inputs.conf
2. C:\Program Files\SplunkUniversalForwarder\etc\apps\myapp\local\inputs.conf
   
   Thanks...

[inventsekar]

Hi @AL3Z 

Both locations are right. 

the first one ... the \etc\system\local\inputs.conf is the default inputs.conf file path. Generally if you dont have different apps, you can use this file alone and specify all files for monitoring, whitelisting and blacklistings. 

if you have lots of things for monitoring, it will be better to group them as "apps" and then have their config files in their particular folders. so troubleshooting will become easy. 

then understanding the file precedence

http://docs.splunk.com/Documentation/Splunk/9.1.1/Admin/Wheretofindtheconfigurationfiles

[AL3Z]

@inventsekar , I believe this is the cause of issue,

from the below snapshot  Creator_Process_Name                                  New_Process_Name

C:\Program Files (x86)\Tanium\Tanium Client\TaniumClient.exe

C:\Windows\System32\cmd.exe

When I excluded the creator processname tanium its newprocess name cmd.exe is also excluded.