How to blacklist a forwarder?

[mad4wknds]

I have a 250 forwarders in my environment. I have one server that no one can reach a solution on due to low priority. The box is killing my indexer with storage errors. I have no control over uninstalling the forwarder.

I would like to blacklist this forwarder. Is this something that can be done and how?

[martin_mueller]

You could deny all incoming connections from that host like this:

iptables -A INPUT -s 1.2.3.4 -j DROP

That's fairly invasive though, talk to your system or network administrators first.

[lukejadamec]

You could try something like this. I'm pretty sure it will also drop _internal logs because it is filtering by host. Put these stanzas in the files on the indexer in splunk\etc\system\local, and restart Splunk. This will only affect new events.

props.conf

[host::hostname]
TRANSFORMS-drop = drop_event
transforms.conf

transforms.conf

[drop_event]
REGEX = .
DEST_KEY = queue
FORMAT = nullQueue

[kristian_kolb · Accepted solution]

One thing that you can do immediately is to set up a regex transform on your indexer to remove the unwanted data. The example below will re-route all data from that host to the trash can.

props.conf

[host::your_host]
TRANSFORMS-remove_stuff = setnull

transforms.conf

[setnull]
REGEX = .
DEST_KEY = queue
FORMAT = nullQueue

NB: you can make a more selective filtering by writing a more specific regex, so that you actually get to keep those events that you like.

Read more here;

http://docs.splunk.com/Documentation/Splunk/6.0.1/Data/Anonymizedatausingconfigurationfiles

/k

[Tinza]

Hi @kristian_kolb, If I create this in a specific app called e.g twistlock_parsing to remove events coming from host 127.0.0.1 only within a specific index e.g azure_twistlock - will this drop all events across all indexes containing that ip? I only want that IP address dropped in index azure_twistlock. I have already tried the solution from this page: https://community.splunk.com/t5/Getting-Data-In/How-to-blacklist-a-host-hosts-is-sending-logs-to-Spl... and it didn't work

[mad4wknds]

Thank you kristian.kolb the "acceptFrom" is the answer I was really looking for.

Thanks again

[kristian_kolb]

lukejadamec, well, regex transforms take place after linebreaking, timestamping etc, so if there is really a lot of crap coming from the evil forwarder, it could affect the event processing... I guess.

[kristian_kolb]

Then I would really suggest fw rule, preferably on the network, but local will also work. Perhaps you should also look at the

acceptFrom = <network_acl>

setting in inputs.conf where you define the forwarder connections (splunktcp:9997, or whatever port you're already listening to). From the docs on inputs.conf:

Entries can also be prefixed with '!' to cause the rule to reject the connection. Rules are applied in order, and the first one to match is used. For example, "!10.1/16, *" will allow connections from everywhere except the 10.1.*.* network.

[teedilo]

Kristian -- I just wanted to thank you for your suggestion to use acceptFrom in inputs.conf. It was the only thing that finally worked for me to shut down traffic from some "rogue" forwarders. Sending things to nullQueue via props.conf and transforms.conf has worked for me for other things, but I couldn't find any combination that would work for this. Thanks again.

[lukejadamec]

Not sure I understand. This should drop everything from the host. What is still getting indexed?

[mad4wknds]

Works great for the "Queue" but I need a total blackout meaning that it is still and blocking other queues.

Thanks for the response.

[lukejadamec]

What version of splunk on the indexer?