Getting Data In

remove whitelist restrictions?

caseynordell
Explorer

I had been using an inputs.conf whitelist to filter event logs by event code but now I would like to send all security logs to splunk from the forwarder. Is simply removing the whitelist entry and restarting the splunk forwarder service enough to do this? i tried this, and it hasn't started sending the data yet, it seems...

before:

[default]
host = <Computer’s Name>
index = <index name>

[WinEventLog://Security]
disabled = 0
whitelist=528,538,540,551,4624,4634,4647,4648,4800,4801 
index = <index name>

after:

[default]
host = <Computer’s Name>
index = <index name>

[WinEventLog://Security]
disabled = 0
index = <index name>
0 Karma
1 Solution

woodcock
Esteemed Legend

You need to restart the Splunk service after this change for the forwarder to reload and act on this update. That should do it but it is not retroactive (only events which happen after the restart will come in).

View solution in original post

woodcock
Esteemed Legend

You need to restart the Splunk service after this change for the forwarder to reload and act on this update. That should do it but it is not retroactive (only events which happen after the restart will come in).

caseynordell
Explorer

thank you so much. out of curiosity, is there any method to making it apply retroactively?

0 Karma

woodcock
Esteemed Legend

If you add these 2 settings and then restart:

start_from = oldest
current_only = 0
Then it should send EVERYTHING again which will cause you to have some events twice so you might use clean eventdata to delete your index data first. BUT REMEMBER TO REMOVE THESE SETTINGS after the forwarder starts sending data for "now".

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...