Have a myriad of webservers in a webfarm where I need to blacklist certain eventIDs/Types (from time to time) to preserve license usage and minimize "clutter" in searches.. It would be very time consuming to update each forwarder individually. (thought of using DFS, but that will change EVERYTHING) Where I am at now.. Already defined a server class.. Have forwarders inside aforementioned webfarm pointed to deployment server.. Question is.. How can I -only- update the "blacklist stanza" and not host value? Need to keep the host uniquely specified for searching purposes.. My inputs.conf file looks something like this. Again, just want to update the blacklist=XXXX value and leave host = alone? [default] host = Server007 [script://$SPLUNK_HOME\bin\scripts\splunk-wmi.path] disabled = 0 [WinEventLog://Security] disabled = true [WinEventLog://System] disabled = true [WinEventLog:Application] disabled = false blacklist = EventCode="XXXX" Message="Object Type:\s+(?!groupPolicyContainer)" Thanks in advance for help with this ... View more

We already have Splunk deployed, (indexer, w/ light forwarders)... The reason for this question is that we've had issues getting splunk to work, but initially had issues getting data from forwarders. After uninstalling and reinstalling a few times, it finally worked.. somehow.. Which is fine.. Problem is, updating forwarders to blacklist certain events to not exceed license limits (saving bandwidth) is going to be a pain to do this every time manually. Having to update conf files on each server and of course -as we grow- it makes more sense to have a deployment server enabled. So, is there anyway to enable a deployment server on a splunk instance that is already installed without having to re-install the indexer and forwarder(s)? If there is a link to help with this, that would be perfect.. Thanks in advance, Joe ... View more