Why are all services still being indexed, even with my WinHostMon whitelist configuration specifying certain services?

[marellasunil]

Hi,

I want to index only the services "AppHostSvc", "Iisadmin" & "AppHostSvc", but even with the below input.conf configuration, all the services are being indexed. Can some one help?

[WinHostMon://service]
type = service
interval = 900
whitelist=Name="AppHostSvc"
whitelist1=Name="Iisadmin"
whitelist2=Name="AppHostSvc"
index=winhost_prod

[ehqtrainorm]

The hacky way I got around this was to use the [powershell://] block in the inputs.conf:

[powershell://<name>]
# Get service status
script = Get-Service -ComputerName localhost | Where-Object DisplayName -in ('Service1','Service2','Service3') | Select-Object Name, DisplayName, Status
# Run every 5 mins
schedule = */5 * * * *
index = <index_name>
sourcetype = <sourcetype_name>

[tomandrews]

It seems that you can use [WMI:Services] to have greater control of which services you are actively monitoring via wmi.conf:

http://blogs.splunk.com/2014/05/30/monitoring-windows-service-state-history/

I can't say this is something I have personally used just yet, but I am considering doing so rather than indexing data about services I'm not worried about.

[richgalloway · Accepted solution]

If I read the docs correctly, the whitelist attribute does not apply to WinHostMon.

[marellasunil]

Hi,
Thanks for the reply.
Is it possible to use blacklist? something like Name!="AppHostSvc"

[richgalloway]

I think blacklist doesn't apply, either.