What is the difference between a inputs.conf whitelist and dorp events with Props.conf and Transfroms.conf?

[aasabatini]

Hi folks,

I need a quick clarification, I need to know if I use a whitelist function on inputs.conf I will saving the license like the drop event configuration by props and transforms.

thanks in advance

Regards

Alessandro

[Jawahir]

Both will be having the same effect, because props and transforms are part of the parsing activity only, data passes through the license after the parsing.  

If you are filtering the data inputs (inputs.conf) using a whitelist or any other way at the time of reading it, you can save some network bandwidth by reducing the amount of data sent toward the Heavy Forwarder/Indexer. And also you can reduce the effort of the parser by reducing the amount of data to be parsed.

Both the case's licenses will be calculated based on the data which the parser outputs.

[PaulPanther]

@aasabatini Yes, you will save license because data that are not on whitelist will be ignored.

[PickleRick]

Whitelists/blacklists in input definition limit filenames which are considered for ingestion. And that's all. They don't drop anything.