topic Re: How do wildcards/whitelist/blacklist interact in inputs.conf? in Getting Data In

How do wildcards/whitelist/blacklist interact in inputs.conf?

hulahoop — Tue, 02 Mar 2010 02:22:18 GMT

Would someone confirm the following observations regarding data input configuration via inputs.conf?

when using wildcards in the spec header, the wildcards expand into a whitelist such that anything set by the _whitelist parameter is overwritten
the _whitelist and _blacklist parameters cannot be used simultaneously in the same input
overlapping inputs are not allowed

If any of these are false, would you kindly explain?

Re: How do wildcards/whitelist/blacklist interact in inputs.conf?

gkanapathy — Tue, 02 Mar 2010 12:27:50 GMT

Correct
No, you can use both. But an item must pass both the whitelist and the blacklist to be indexed, i.e., it must match the whitelist and must not match the blacklist
Officially, correct. However, overlapping inputs actually are loaded and monitored. It's just that if there are multiple inputs that include a file path, it is can be difficult to determine which clause is applied to a given file, especially if the clauses involve wildcards or whitelists.

Re: How do wildcards/whitelist/blacklist interact in inputs.conf?

jrodman — Sat, 06 Mar 2010 06:51:54 GMT

Per 3.

If by 'overlapping inputs' you mean say /var/log and /var/log, the settings are simply merged. One setting is going to win, the other setting discarded.

If, on the other hand, you mean /var and /var/log then something happens, and that something that happens is almost assuredly not what you want. Note that this case is addressed in 4.1, in that we intend it to be usable and reasonable

Re: How do wildcards/whitelist/blacklist interact in inputs.conf?

mayler — Wed, 14 Apr 2010 01:31:14 GMT

Lots of good info in the "new" 4.1 manual. It seems much easier to configure. Thank you SPLUNK http://www.splunk.com/base/Documentation/4.1/Admin/Inputsconf