What is the best way to blacklist, in GUI compared with inputs.conf?

[saeedb101]

We have a cluster of three indexers, a Cluster Master, a Search Head/License Master, and a Heavy forwarder. What is the best way to blacklist, or whitelist, certain classes of input data? In the Cluster Master GUI, or through the input.cnfg on the Forwarder?

Thanks,
Sid Bastani

[yannK · Accepted solution]

Can you clarify ?
"way to blacklist, or whitelist, certain classes of input data"

• to block a log file, the best is to configure the inputs.conf on the forwarders, to skip the files (blacklists and strict monitor paths)
• to block some windows events (wineventlog), the best is to setup eventcode or regex blacklists in inputs.conf on the windows forwarder.
• otherwise, to drop events (but not all), you have to look at nullQueue filtering, and setup the filters (in props.conf and transforms.conf) on the servers parsing the logs: indexers, or heavy forwarders ( or for special indexed_extractions sourcetypes, on the forwarders) see : http://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Routeandfilterdatad#Filter_event_data_...

[saeedb101]

Thank you for your answer. I am really curious to find out why it is not a good idea to use the GUI for blacklisting or whitelisting? You know, through "Server Classes", "Clients", and "Apps"? Don't we obtain the same results when we use the "Include (Whitelist)" and "Exclude (Blacklist" GUI page?

Your advice would be very much appreciated.

[yannK]

I see, when you meant the GUI, you were referring to the "forwarder management/deployment server" UI.

Then yes, you can configure your inputs filters from there, as they are the ones that will be pushed to the deployment clients (i.e. the forwarders, in inputs.conf)

Remark : do not get confused between the whitelist/backlist on the inputs monitor paths, and the whitelist/blacklist on the hostnames used to apply classes to particular subset of forwarders/deploymentclients.