https://community.splunk.com/t5/Getting-Data-In/How-to-implement-whitelist-instead-of-blacklist-for-Splunk/m-p/443741#M77283 <P>Hi Gnanasekar,<BR /> where ever blacklist can be used, it can be replaced with whitelist(vice versa is true as well)<BR /> maybe, if you give us the config file, we can suggest how to do this.</P> <P>for example - assume there are two host names ABC.company.com and DEF.company.com</P> <P>[serverClass:all_apps_inputs]<BR /> restartSplunkd = true<BR /> blacklist.0 = splunk_indexers<BR /> whitelist.0 = ABC*</P> <P>[serverClass:all_apps_inputs]<BR /> restartSplunkd = true<BR /> blacklist.0 = splunk_indexers<BR /> blacklist.1 = DEF*</P> Tue, 29 Sep 2020 21:47:31 GMT inventsekar 2020-09-29T21:47:31Z https://community.splunk.com/t5/Getting-Data-In/How-to-implement-whitelist-instead-of-blacklist-for-Splunk/m-p/443740#M77282 <P>The Splunk plugin for <A href="https://goo.gl/jzrGNW">Jenkins implements</A> a blacklist model for determining which Jobs send their information to Splunk (i.e. regex where matching jobs will be ignored) - is there a way to implement whitelist model that isn't just horrendous regex? I'm looking to only send to Splunk for a few Jobs out of many.</P> Wed, 24 Oct 2018 06:32:58 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-implement-whitelist-instead-of-blacklist-for-Splunk/m-p/443740#M77282 GnanasekarP 2018-10-24T06:32:58Z https://community.splunk.com/t5/Getting-Data-In/How-to-implement-whitelist-instead-of-blacklist-for-Splunk/m-p/443741#M77283 <P>Hi Gnanasekar,<BR /> where ever blacklist can be used, it can be replaced with whitelist(vice versa is true as well)<BR /> maybe, if you give us the config file, we can suggest how to do this.</P> <P>for example - assume there are two host names ABC.company.com and DEF.company.com</P> <P>[serverClass:all_apps_inputs]<BR /> restartSplunkd = true<BR /> blacklist.0 = splunk_indexers<BR /> whitelist.0 = ABC*</P> <P>[serverClass:all_apps_inputs]<BR /> restartSplunkd = true<BR /> blacklist.0 = splunk_indexers<BR /> blacklist.1 = DEF*</P> Tue, 29 Sep 2020 21:47:31 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-implement-whitelist-instead-of-blacklist-for-Splunk/m-p/443741#M77283 inventsekar 2020-09-29T21:47:31Z