remove whitelist restrictions?

[caseynordell]

I had been using an inputs.conf whitelist to filter event logs by event code but now I would like to send all security logs to splunk from the forwarder. Is simply removing the whitelist entry and restarting the splunk forwarder service enough to do this? i tried this, and it hasn't started sending the data yet, it seems...

before:

[default]
host = <Computer’s Name>
index = <index name>

[WinEventLog://Security]
disabled = 0
whitelist=528,538,540,551,4624,4634,4647,4648,4800,4801 
index = <index name>

after:

[default]
host = <Computer’s Name>
index = <index name>

[WinEventLog://Security]
disabled = 0
index = <index name>

[woodcock · Accepted solution]

You need to restart the Splunk service after this change for the forwarder to reload and act on this update. That should do it but it is not retroactive (only events which happen after the restart will come in).

[caseynordell]

thank you so much. out of curiosity, is there any method to making it apply retroactively?

[woodcock]

If you add these 2 settings and then restart:

start_from = oldest
current_only = 0
Then it should send EVERYTHING again which will cause you to have some events twice so you might use clean eventdata to delete your index data first. BUT REMEMBER TO REMOVE THESE SETTINGS after the forwarder starts sending data for "now".