Getting Data In

How do wildcards/whitelist/blacklist interact in inputs.conf?

hulahoop
Splunk Employee
Splunk Employee

Would someone confirm the following observations regarding data input configuration via inputs.conf?

  • when using wildcards in the spec header, the wildcards expand into a whitelist such that anything set by the _whitelist parameter is overwritten
  • the _whitelist and _blacklist parameters cannot be used simultaneously in the same input
  • overlapping inputs are not allowed

If any of these are false, would you kindly explain?

0 Karma
1 Solution

gkanapathy
Splunk Employee
Splunk Employee
  • Correct
  • No, you can use both. But an item must pass both the whitelist and the blacklist to be indexed, i.e., it must match the whitelist and must not match the blacklist
  • Officially, correct. However, overlapping inputs actually are loaded and monitored. It's just that if there are multiple inputs that include a file path, it is can be difficult to determine which clause is applied to a given file, especially if the clauses involve wildcards or whitelists.

View solution in original post

mayler
Path Finder

Lots of good info in the "new" 4.1 manual. It seems much easier to configure. Thank you SPLUNK http://www.splunk.com/base/Documentation/4.1/Admin/Inputsconf

jrodman
Splunk Employee
Splunk Employee

Per 3.

If by 'overlapping inputs' you mean say /var/log and /var/log, the settings are simply merged. One setting is going to win, the other setting discarded.

If, on the other hand, you mean /var and /var/log then something happens, and that something that happens is almost assuredly not what you want. Note that this case is addressed in 4.1, in that we intend it to be usable and reasonable

0 Karma

gkanapathy
Splunk Employee
Splunk Employee
  • Correct
  • No, you can use both. But an item must pass both the whitelist and the blacklist to be indexed, i.e., it must match the whitelist and must not match the blacklist
  • Officially, correct. However, overlapping inputs actually are loaded and monitored. It's just that if there are multiple inputs that include a file path, it is can be difficult to determine which clause is applied to a given file, especially if the clauses involve wildcards or whitelists.
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...