https://community.splunk.com/t5/Getting-Data-In/how-to-view-datasets/m-p/499965#M99966 <P>The whitelist is probably in a lookup file, but could be within the alert itself. Find out by examining the query within the alert.<BR /><BR /> If you see <CODE>lookup</CODE> or <CODE>inputlookup</CODE> then the whitelist likely is in the lookup file referenced by that command.<BR /> It's also possible the whitelist is hardcoded in the query using <CODE>NOT</CODE>. In that case, you can add the new server to that list or re-write the query to use a lookup file.</P> Sun, 02 Feb 2020 18:32:14 GMT richgalloway 2020-02-02T18:32:14Z https://community.splunk.com/t5/Getting-Data-In/how-to-view-datasets/m-p/499964#M99965 <P>Within splunk cloud, I suspect we are whitelisting a list of approved snmp servers. I need to "whitelist" a new snmp server so it doesn't generate alerts. What would this list be called? Datasets? Where would I find this list so I can add another entry to it? </P> Sun, 02 Feb 2020 16:35:22 GMT https://community.splunk.com/t5/Getting-Data-In/how-to-view-datasets/m-p/499964#M99965 trojan_81 2020-02-02T16:35:22Z https://community.splunk.com/t5/Getting-Data-In/how-to-view-datasets/m-p/499965#M99966 <P>The whitelist is probably in a lookup file, but could be within the alert itself. Find out by examining the query within the alert.<BR /><BR /> If you see <CODE>lookup</CODE> or <CODE>inputlookup</CODE> then the whitelist likely is in the lookup file referenced by that command.<BR /> It's also possible the whitelist is hardcoded in the query using <CODE>NOT</CODE>. In that case, you can add the new server to that list or re-write the query to use a lookup file.</P> Sun, 02 Feb 2020 18:32:14 GMT https://community.splunk.com/t5/Getting-Data-In/how-to-view-datasets/m-p/499965#M99966 richgalloway 2020-02-02T18:32:14Z