How to configure inputs.conf to blacklist Windows Event Logs on indexer?

[kpavan]

Hi,

I below is the inputs.conf which i have configured on my indexer, but it is not blocking anything. is this is correct format or not. I need to block it on indexer level since i have more forwarders. Please let me know the correct configuration.

[WinEventLog://Application]
disabled = 1
start_from = newest
evt_resolve_ad_obj = 1
checkpointInterval = 5
blacklist = *

Thanks!

[ppablo]

Hi @kpavan

From this blog post on filtering Windows Event Logs with blacklist, it seems like you can only filter with inputs.conf on the forwarder.

http://blogs.splunk.com/2013/10/14/windows-event-logs-in-splunk-6/

The author mentions in the comment thread that they do have an earlier blog post on filtering at the indexer level, but I didn't have any luck finding that post specific to what you're looking for. If this doesn't resolve your issue, hopefully a configuration expert on filtering can chime in.

[kpavan]

is there a way to block the specific host/ip which sending entire logs on indexer.

[MuS]

If you want it to be filtered on the indexer follow this docs about Filter event data and send to queues. This way you can nullQueue unneeded events.

[kpavan]

Thanks for your quick response!

Actually it did worked in UF. Since I have too many UF's, so i would like to filter on indexer level.

[kpavan]

i did configured the same on UF inputs.conf it is blocking, but when i applied on indexer it is not

[WinEventLog://System]
disabled = 0
start_from = newest
evt_resolve_ad_obj = 1
checkpointInterval = 5
blacklist = 7036

[ITICSNORTH]

even it's not working on UF to 😞