https://community.splunk.com/t5/Getting-Data-In/wildcard-in-inputs-conf-splunktcp-stanza/m-p/54350#M10517 <P>Hi guys,</P> <P>Is it possible to limit a splunk receiver via host wildcard.</P> <P>So curently I have in inputs.conf<BR /> [splunktcp://9997]</P> <P>I want to limit this strictly to various hosts only: So I can do this in inputs.conf:<BR /> [splunktcp//:lin01:9997]<BR /> [splunktcp//:lin02:9997]<BR /> [splunktcp//:lin03:9997]</P> <P>How is it now possible to limit this via a wildcard, ie. only receive allow receive for hostnames begining with (whitelist) 'lin' (linux in my case) and not recieve data from a host called 'win01'?</P> <P>Is this possible?</P> <P>Thanks.. </P> Thu, 19 Jan 2012 05:43:00 GMT mark 2012-01-19T05:43:00Z https://community.splunk.com/t5/Getting-Data-In/wildcard-in-inputs-conf-splunktcp-stanza/m-p/54350#M10517 <P>Hi guys,</P> <P>Is it possible to limit a splunk receiver via host wildcard.</P> <P>So curently I have in inputs.conf<BR /> [splunktcp://9997]</P> <P>I want to limit this strictly to various hosts only: So I can do this in inputs.conf:<BR /> [splunktcp//:lin01:9997]<BR /> [splunktcp//:lin02:9997]<BR /> [splunktcp//:lin03:9997]</P> <P>How is it now possible to limit this via a wildcard, ie. only receive allow receive for hostnames begining with (whitelist) 'lin' (linux in my case) and not recieve data from a host called 'win01'?</P> <P>Is this possible?</P> <P>Thanks.. </P> Thu, 19 Jan 2012 05:43:00 GMT https://community.splunk.com/t5/Getting-Data-In/wildcard-in-inputs-conf-splunktcp-stanza/m-p/54350#M10517 mark 2012-01-19T05:43:00Z https://community.splunk.com/t5/Getting-Data-In/wildcard-in-inputs-conf-splunktcp-stanza/m-p/54351#M10518 <P>Judging from experience and (most importantly) from the <A href="http://docs.splunk.com/Documentation/Splunk/latest/Admin/Inputsconf">inputs.conf.spec file</A>, I don't believe that wildcards are accepted here.</P> <P>An easy way to test this would be to attempt to set this up with a wildcard, up the log level of the <CODE>TcpInputProc</CODE> channel to DEBUG in <CODE>$SPLUNK_HOME/etc/log.cfg</CODE> and see what turns up in splunkd.log when you restart splunkd and the input is set up.</P> Thu, 19 Jan 2012 06:46:58 GMT https://community.splunk.com/t5/Getting-Data-In/wildcard-in-inputs-conf-splunktcp-stanza/m-p/54351#M10518 hexx 2012-01-19T06:46:58Z