Getting Data In

What is the best way to blacklist, in GUI compared with inputs.conf?

saeedb101
New Member

We have a cluster of three indexers, a Cluster Master, a Search Head/License Master, and a Heavy forwarder. What is the best way to blacklist, or whitelist, certain classes of input data? In the Cluster Master GUI, or through the input.cnfg on the Forwarder?

Thanks,
Sid Bastani

0 Karma
1 Solution

yannK
Splunk Employee
Splunk Employee

Can you clarify ?
"way to blacklist, or whitelist, certain classes of input data"

  • to block a log file, the best is to configure the inputs.conf on the forwarders, to skip the files (blacklists and strict monitor paths)
  • to block some windows events (wineventlog), the best is to setup eventcode or regex blacklists in inputs.conf on the windows forwarder.
  • otherwise, to drop events (but not all), you have to look at nullQueue filtering, and setup the filters (in props.conf and transforms.conf) on the servers parsing the logs: indexers, or heavy forwarders ( or for special indexed_extractions sourcetypes, on the forwarders) see : http://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Routeandfilterdatad#Filter_event_data_...

View solution in original post

0 Karma

yannK
Splunk Employee
Splunk Employee

Can you clarify ?
"way to blacklist, or whitelist, certain classes of input data"

  • to block a log file, the best is to configure the inputs.conf on the forwarders, to skip the files (blacklists and strict monitor paths)
  • to block some windows events (wineventlog), the best is to setup eventcode or regex blacklists in inputs.conf on the windows forwarder.
  • otherwise, to drop events (but not all), you have to look at nullQueue filtering, and setup the filters (in props.conf and transforms.conf) on the servers parsing the logs: indexers, or heavy forwarders ( or for special indexed_extractions sourcetypes, on the forwarders) see : http://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Routeandfilterdatad#Filter_event_data_...

View solution in original post

0 Karma

saeedb101
New Member

Thank you for your answer. I am really curious to find out why it is not a good idea to use the GUI for blacklisting or whitelisting? You know, through "Server Classes", "Clients", and "Apps"? Don't we obtain the same results when we use the "Include (Whitelist)" and "Exclude (Blacklist" GUI page?

Your advice would be very much appreciated.

0 Karma

yannK
Splunk Employee
Splunk Employee

I see, when you meant the GUI, you were referring to the "forwarder management/deployment server" UI.

Then yes, you can configure your inputs filters from there, as they are the ones that will be pushed to the deployment clients (i.e. the forwarders, in inputs.conf)

Remark : do not get confused between the whitelist/backlist on the inputs monitor paths, and the whitelist/blacklist on the hostnames used to apply classes to particular subset of forwarders/deploymentclients.

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!