Getting Data In

Inputs.conf not working for Splunk 6.3.0

pranov97
New Member

Recently we upgraded the Splunk version to 6.3.0

We are trying to filter certain event codes from Security and System LogNames and it is not filtering.

[WinEventLog://Security]
disabled = 0
evt_resolve_ad_obj = 0
blacklist1 = 4656,4689,4688

[WinEventLog://System]
disabled = 0
evt_resolve_ad_obj = 0
blacklist1 = 7036,5009,98,7045

Updated Inputs.Conf under ....\etc\system\local. This did not work.

Then updated Inputs.Conf under ....\etc\apps\SplunkLightForwarder\default. This did not work

What am I missing here? Please advise.

Thanks
Anand

0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

According to the inputs.conf docs, you need to use the unnumbered blacklist key to supply a list of event codes:

* The base unumbered whitelist and blacklist support two formats, a list of integer event IDs, and a list of key=regex pairs.
* Numbered whitelist/blacklist settings such as whitelist1 do not support the Event ID list format.

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

According to the inputs.conf docs, you need to use the unnumbered blacklist key to supply a list of event codes:

* The base unumbered whitelist and blacklist support two formats, a list of integer event IDs, and a list of key=regex pairs.
* Numbered whitelist/blacklist settings such as whitelist1 do not support the Event ID list format.

pranov97
New Member

After I modified the inputs.conf on the Splunk Forwarder client, it started to work. Modify the local inputs.conf and that should work.

The local inputs.conf on the serve side still did not work.

Thanks
Anand

0 Karma

pranov97
New Member

I tried that and it is still not working. Is there any other thing that I am missing?

Thanks
Anand

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...