This is interesting because I have the same question. I suppose we need to use the whitelist parameter. The challenge I see is that how do you know what order number to use when adding them to the list? Is the API smart enough to add the server in the next sequential number? Too bad Splunk has these number orders for serverclass. It's not very friendly from an administration perspective. We actually have verion 7.2.0 now. Any suggestions on the best way to add a server if you do not know the whitelist order number using the API?