topic Re: Removing whitelist entries in serverclass.conf does not remove them in Deployment Architecture

Removing whitelist entries in serverclass.conf does not remove them

aelliott — Mon, 05 May 2014 14:50:22 GMT

I added 8 dns names to my whitelist through the "Edit Clients" for my Server Class on my deployment server.
I saved and reloaded, then went back in to edit it.
I removed all but one entry, hit save and reload and got the following error:
In handler 'serverclasses': Gap in numbered regexes: expected attribute=whitelist.8 not found.

I believe this is a bug within the Edit Clients UI.

Re: Removing whitelist entries in serverclass.conf does not remove them

lguinn2 — Mon, 05 May 2014 18:53:16 GMT

It sounds like a bug.

For a work-around, go to the serverclass.conf file. You will probably see entries like this somewhere in the file:

whitelist.0= yourhostname1
whitelist.1= yourhostname2
whitelist.3= yourhostname8

Or perhaps the first whitelist.x is not whitelist.0!

In serverclass.conf the whitelists are numbered. The first one must be whitelist.0 and no numbers can be skipped in the list. If you see that these rules have been violated then

Please document what happened for Splunk support! Perhaps you could even run a ./splunk diag before fixing the problem.
Edit the file and correct the problem.
Use this command to reload serverclass.conf: ./splunk reload deploy-server
Go back into the UI and see if it works!

Even if the workaround solves the problem, please report it to http://support.splunk.com

Re: Removing whitelist entries in serverclass.conf does not remove them

laurarokkanen — Tue, 23 Sep 2014 13:27:52 GMT

Same problem here, had to heavily edit a whitelist and got the same kind of whining (note! new whitelist was shorter than the old one!)

I worked around this by deleting a few hosts (one by one + save) from the whitelist until I had a number of hosts = the # hosts I was adding, then it allowed me to modify the whole list.

definitely sounds like a bug

Re: Removing whitelist entries in serverclass.conf does not remove them

wrangler2x — Fri, 05 Dec 2014 21:58:13 GMT

I had a whitelist that was number starting from 1 rather than 0. I never saw any messages about it in splunk 5.1.3, but after I upgraded to 6.1.5 I did. However though it told me the correct server class, it incorrectly identified the problem as missing whitelist.9 rather than whitelist.0 #headscratcher (until I read this post).

Re: Removing whitelist entries in serverclass.conf does not remove them

wrangler2x — Fri, 05 Dec 2014 23:13:23 GMT

I filed a bug report: link text