Hi,
I below is the inputs.conf which i have configured on my indexer, but it is not blocking anything. is this is correct format or not. I need to block it on indexer level since i have more forwarders. Please let me know the correct configuration.
[WinEventLog://Application]
disabled = 1
start_from = newest
evt_resolve_ad_obj = 1
checkpointInterval = 5
blacklist = *
Thanks!
Hi @kpavan
From this blog post on filtering Windows Event Logs with blacklist, it seems like you can only filter with inputs.conf on the forwarder.
http://blogs.splunk.com/2013/10/14/windows-event-logs-in-splunk-6/
The author mentions in the comment thread that they do have an earlier blog post on filtering at the indexer level, but I didn't have any luck finding that post specific to what you're looking for. If this doesn't resolve your issue, hopefully a configuration expert on filtering can chime in.
is there a way to block the specific host/ip which sending entire logs on indexer.
If you want it to be filtered on the indexer follow this docs about Filter event data and send to queues. This way you can nullQueue
unneeded events.
Thanks for your quick response!
Actually it did worked in UF. Since I have too many UF's, so i would like to filter on indexer level.
i did configured the same on UF inputs.conf it is blocking, but when i applied on indexer it is not
[WinEventLog://System]
disabled = 0
start_from = newest
evt_resolve_ad_obj = 1
checkpointInterval = 5
blacklist = 7036
even it's not working on UF to 😞