Getting Data In

remove whitelist restrictions?

Explorer

I had been using an inputs.conf whitelist to filter event logs by event code but now I would like to send all security logs to splunk from the forwarder. Is simply removing the whitelist entry and restarting the splunk forwarder service enough to do this? i tried this, and it hasn't started sending the data yet, it seems...

before:

[default]
host = <Computer’s Name>
index = <index name>

[WinEventLog://Security]
disabled = 0
whitelist=528,538,540,551,4624,4634,4647,4648,4800,4801 
index = <index name>

after:

[default]
host = <Computer’s Name>
index = <index name>

[WinEventLog://Security]
disabled = 0
index = <index name>
0 Karma
1 Solution

Esteemed Legend

You need to restart the Splunk service after this change for the forwarder to reload and act on this update. That should do it but it is not retroactive (only events which happen after the restart will come in).

View solution in original post

Esteemed Legend

You need to restart the Splunk service after this change for the forwarder to reload and act on this update. That should do it but it is not retroactive (only events which happen after the restart will come in).

View solution in original post

Explorer

thank you so much. out of curiosity, is there any method to making it apply retroactively?

0 Karma

Esteemed Legend

If you add these 2 settings and then restart:

startfrom = oldest
current
only = 0
Then it should send EVERYTHING again which will cause you to have some events twice so you might use clean eventdata to delete your index data first. BUT REMEMBER TO REMOVE THESE SETTINGS after the forwarder starts sending data for "now".

0 Karma