topic Re: Error when adding new whitelist in inputs.conf in Alerting

Error when adding new whitelist in inputs.conf

azrad — Thu, 09 Jul 2020 01:50:44 GMT

Hi Splunk Community

We have created few whitelist in our inputs.conf file. It was all fine until i try to enter the following:

whitelist10=Type="Information" SourceName="Customer.Service" Message="*Request Info:ContactCustomer - CreateNewContact*"

after restarting my splunk, i get the following:

Invalid key in stanza [WinEventLog://Application] in C:\Program Files\SplunkUniversalForwarder\etc\system\local\inputs.conf, line 38: whitelist12 (value: Type="Information" SourceName="Customer.Service" Message="*Request Info:ContactCustomer - CreateNewContact*").

and it gives me the following:

Did you mean 'whitelist'?

Did you mean 'whitelist1'?

Did you mean 'whitelist2'?

Did you mean 'whitelist3'?

Did you mean 'whitelist4'?

Did you mean 'whitelist5'?

Did you mean 'whitelist6'?

Did you mean 'whitelist7'?

Did you mean 'whitelist8'?

Did you mean 'whitelist9'?

Is there a limit to number of whitelist we can create?

Or what is the next correct key to use after whitelist9 ?

thanks!!

Azrad

Re: Error when adding new whitelist in inputs.conf

harsmarvania57 — Thu, 09 Jul 2020 09:04:29 GMT

Hi,

Yes there is limitation when you specify whitelist/blacklist for Windows Event Montitoring

https://docs.splunk.com/Documentation/Splunk/8.0.4/Admin/Inputsconf#Windows_Event_Log_Monitor

* Numbered whitelist settings are permitted from 1 to 9, so whitelist1 through whitelist9 and blacklist1 through blacklist9 are supported. * If no whitelist or blacklist rules are present, the input reads all events.

Re: Error when adding new whitelist in inputs.conf

azrad — Mon, 13 Jul 2020 22:45:31 GMT

hi @harsmarvania57

Thanks for the answer. We made some changes to our config and combined the whitelist where possible.