Getting Data In

How to drop events using inputs.conf?

leejones4
Explorer

We have a Syslog server collecting data from Meraki Wireless devices.  There is a UF installed on the Syslog server sending data to Splunk.  I have been trying to use Blacklist to filter out the ICMP protocol events which we don't need and I have been unable to drop them.  The entry in my inputs.conf file for this are:

[monitor:///syslog0/syslog/meraki/*/*.log]
disabled=0
host_segment = 4

blacklist1 = protocol=icmp
blacklist2 = "(?192.\168.\30.\143.)"
blacklist3 = 10.\12.\239.\7
index = network
sourcetype = meraki

I have tried a number of variations and have been unable to get the "protocol=icmp" to drop.  Is there something obvious that I am missing?

Thanks in advance for any suggestions.

Labels (2)
0 Karma
1 Solution

PickleRick
SplunkTrust
SplunkTrust

Yes. You're missing one important thing. Blacklisting events on input works for windows event log input only. It doesn't even work for windows events pulled with WMI. And definitely does not work with file monitor input.

You have to filter your events in props/transforms on the first "heavy" component - HF or indexer - in event's path.

View solution in original post

PickleRick
SplunkTrust
SplunkTrust

Yes. You're missing one important thing. Blacklisting events on input works for windows event log input only. It doesn't even work for windows events pulled with WMI. And definitely does not work with file monitor input.

You have to filter your events in props/transforms on the first "heavy" component - HF or indexer - in event's path.

leejones4
Explorer

That was what I was wondering.  Thank you for pointing it out, now I can move on and try the props.conf and the transforms. 

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...