How to stop ingesting from 1 of 4 firewalls?

[sandyvaldez]

I need to stop ingesting from 1 of 4 of my firewalls. 

The path of our architecture is  firewalls >>>syslog>>>>deployment server>>indexer cluster>>>>search head

I have tried commenting them out under deployment apps (inputs.conf ) in the deployment server, but  I am still seeing ingestion from that firewall. 

Any help is appreciated! 

[venky1544]

@sandyvaldez 

are you sure its syslog >>deployment server 

usually its  syslog>> HF >>indexer cluster 

i guess you are missing a HF component and its where you were probably should be looking

[sandyvaldez]

Hi and Thanks for your insight. See below. 

This is the exact architecture. This was created before I came onboard. Do you know where I would need to remove or comment out this firewall?

[somesoni2]

If your firewalls are sending data to Splunk via syslog (which means Splunk is "receiving" the data from firewall and not "pulling/fetching" it), then best way would be to turn off syslog sending on the firewall appliance from which you don't want data to come. 

Other option would be to "ignore" the incoming data from that 1 firewall. (I would go this route if I can't do first approach). You'll have to look at your Syslog server (splunklogs01) and find the data input which is monitoring syslog data files from that firewall and find a way to turn it off (either commenting the monitoring of that firewall related file if there is a separate file monitoring setup for each firewall OR adding blacklist attribute if a single monitoring stanza is used).

If they all log into same log file, then you'd have to filter the data and drop those events from being indexed.  This filtering would be setup on your indexers. You can find filtering configurations here: https://docs.splunk.com/Documentation/Splunk/8.2.5/Forwarding/Routeandfilterdatad#Filter_event_data_...