We want to build a self-service for customers to deploy apps on our splunk instance. But we want to blacklist some files the customer can deploy, exp the customer should not be able to provide an indexes.conf or authorize.conf. So we would like to preprocess the delivered package and blacklist unwanted files. For example, we would blacklist indexes.conf, but do we also have to blacklist INDEXES.CONF?
Thank you very much for any hints..
Should be easy enough to try that out I guess?
Anyway, simple solution of course is to make the blacklisting case insensitive, regardless. Even if Splunk would be ignoring INDEXES.CONF, I'd still not want such files in an app, since it could cause confusion later on.