Splunk Enterprise Security

How to Splunk getting data from windows servers

kiranhar
New Member

Hello,

I want to blacklist the first four host to stop getting data from these servers, I have blacklisted them in the serverclass.conf, but still I am getting data on Splunk search head. please advise what is right way to block/stop the data to splunk, please note i dont want to unstall/stop splunk universal forwards in the server ( remote shost)

[serverClass:ZU_All_windows_OS_member_servers_except_Exchange_servers]
blacklist.42 = WC-EMPSHARE
blacklist.43 = WC-STUSHARE
blacklist.45 = DC-EMPSHARE
blacklist.46 = DC-STUSHARE
whitelist.0 = SUHRODC02
whitelist.1 = MDPROD
whitelist.10 = KIWIK
whitelist.11 = WC-DXBADM-04
whitelist.12 = AEBFAPN01
whitelist.13 = GC-ADSS
whitelist.14 = GK-WEBFAPN02
whitelist.15 = MK-AUHADS2
whitelist.16 = LK-ZTEJ
whitelist.17 = DK-CSDXB07
whitelist.18 = LLBBZU

0 Karma

FrankVl
Ultra Champion

Have you checked from the Forwarder Management page on your Deployment Server whether those clients are indeed effectively no longer participating in that serverclass?
Have you confirmed on those respective servers that the respective inputs configuration has indeed been removed? Could there be some other configuration in place that still enables these inputs (e.g. in system local due to activating these inputs during UF install procedure)?

0 Karma

kiranhar
New Member

We don’t required these serve to forward the logs to Splunk ... my confirmation is working Splunk stop collecting the logs after making them blacklist but it some time to initiate configuration I believe...

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!