Getting Data In

How to blacklist inputs.conf?

garrywilmeth
Loves-to-Learn Lots

Hello,

We have a rather noisy agent that is logging about 19GB of data daily.  How can I filter the following from the inputs.conf?
 
Process Information: 
 
Process ID: 0x1450 
Process Name: C:\Program Files\Rapid7\Insight Agent\components\insight_agent\3.1.5.14\ir_agent.exe
 
 
Thanks,
 
Garry
Labels (2)
Tags (2)
0 Karma

gcusello
Legend

Hi @garrywilmeth,

if you're speaking of Wineventlog, you can blacklist some EventCode in the inputs.conf; for more infos see at https://docs.splunk.com/Documentation/Splunk/8.2.6/Admin/Inputsconf

In few words, put in the winevenlog stanza

# Filtering at the input layer is desirable to reduce the total
# processing load in network transfer and computation on the Splunk platform
# nodes that acquire and processing Event Log data.

blacklist = <list of eventIDs> | key=regex [key=regex]

If instead it's another kind of data source, you have to filter your data on the Indexers or (if present) on Heavy Forwarders following the instructions at https://docs.splunk.com/Documentation/Splunk/8.2.6/Forwarding/Routeandfilterdatad#Filter_event_data_...

In few words, if you need to discard only some data (the ones with the string "C:\Program Files\Rapid7\Insight Agent\components\insight_agent\3.1.5.14\ir_agent.exe") you have to put in props.conf:

[source::/var/log/messages]
TRANSFORMS-null= setnull

and in transforms.conf

[setnull]
REGEX = C:\\Program Files\\Rapid7\\Insight Agent\\components\\insight_agent\\3.1.5.14\\ir_agent.exe
DEST_KEY = queue
FORMAT = nullQueue

and restart Splunk.

 Ciao.

Giuseppe

0 Karma

garrywilmeth
Loves-to-Learn Lots

Hello @gcusello,

Thank you for the reply.  Yes, the events are from the Windows Event Security log.  I don't want to filter all 4703 events coming from the windows event log, only those also containing IR_agent.exe.  As far as the path for the agent, the filename IR_agent.exe is constant where the path contains the version number and changes when the agent is upgraded.

Can this be done at the inputs.conf level?

 

Thanks,

Garry

0 Karma

gcusello
Legend

Hi @garrywilmeth,

yes, you can, as you can see in the inputs.conf documentation, you have:

blacklist = <list of eventIDs> | key=regex [key=regex]

you can blacklist an EventCode or a regex in inputs.conf.

Ciao.

Giuseppe

0 Karma

garrywilmeth
Loves-to-Learn Lots

Something like this?

blacklist = EventCode=“4703” Message=“\\ir_agent.exe”
0 Karma

gcusello
Legend

Hi @garrywilmeth,

check the regex in Splunk indexed data, if this regex match the events to discard you can apply it to blacklist.

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...