We have a cluster of three indexers, a Cluster Master, a Search Head/License Master, and a Heavy forwarder. What is the best way to blacklist, or whitelist, certain classes of input data? In the Cluster Master GUI, or through the input.cnfg on the Forwarder?
Thank you for your answer. I am really curious to find out why it is not a good idea to use the GUI for blacklisting or whitelisting? You know, through "Server Classes", "Clients", and "Apps"? Don't we obtain the same results when we use the "Include (Whitelist)" and "Exclude (Blacklist" GUI page?
I see, when you meant the GUI, you were referring to the "forwarder management/deployment server" UI.
Then yes, you can configure your inputs filters from there, as they are the ones that will be pushed to the deployment clients (i.e. the forwarders, in inputs.conf)
Remark : do not get confused between the whitelist/backlist on the inputs monitor paths, and the whitelist/blacklist on the hostnames used to apply classes to particular subset of forwarders/deploymentclients.