topic Re: Is there a way to use an external list file to whitelist or blacklist hosts in serverclass.conf? in Getting Data In

Is there a way to use an external list file to whitelist or blacklist hosts in serverclass.conf?

Susannajuurinen — Thu, 06 Oct 2016 07:31:01 GMT

Is there a way to use external lists with whitelist filtering? For example if I had systems A and B with several hosts, could I create a list like hosts.txt and then refer to that list and its content? Something like below:

whitelist.0 = hosts.txt systemB

hosts.txt
[systemA]
host1
host2

[systemB]
host3
host4

Thanks for any help!

Re: Is there a way to use an external list file to whitelist or blacklist hosts in serverclass.conf?

lguinn2 — Thu, 06 Oct 2016 21:49:32 GMT

AFAIK, you can't do that for serverclass.conf

Re: Is there a way to use an external list file to whitelist or blacklist hosts in serverclass.conf?

Susannajuurinen — Mon, 10 Oct 2016 05:59:56 GMT

Thanks Lisa,

Do you know if that kind of a feature is added to Splunk in the future? It would make managing the serverclass.conf (and other confs too) a lot more easier if hosts could be centrally grouped.

Re: Is there a way to use an external list file to whitelist or blacklist hosts in serverclass.conf?

regriffith — Tue, 29 Sep 2020 11:47:43 GMT

I use this for managing a large number of hosts. In one case I temporarily used it with up to a nine thousand host entries.

Entry in the serverclass.conf

[serverClass:specific_host]
whitelist.from_pathname = etc/system/local/host.txt
restartSplunkd = 1