How do wildcards/whitelist/blacklist interact in inputs.conf?

[hulahoop]

Would someone confirm the following observations regarding data input configuration via inputs.conf?

• when using wildcards in the spec header, the wildcards expand into a whitelist such that anything set by the _whitelist parameter is overwritten
• the _whitelist and _blacklist parameters cannot be used simultaneously in the same input
• overlapping inputs are not allowed

If any of these are false, would you kindly explain?

[mayler]

Lots of good info in the "new" 4.1 manual. It seems much easier to configure. Thank you SPLUNK http://www.splunk.com/base/Documentation/4.1/Admin/Inputsconf

[jrodman]

Per 3.

If by 'overlapping inputs' you mean say /var/log and /var/log, the settings are simply merged. One setting is going to win, the other setting discarded.

If, on the other hand, you mean /var and /var/log then something happens, and that something that happens is almost assuredly not what you want. Note that this case is addressed in 4.1, in that we intend it to be usable and reasonable

[gkanapathy · Accepted solution]

• Correct
• No, you can use both. But an item must pass both the whitelist and the blacklist to be indexed, i.e., it must match the whitelist and must not match the blacklist
• Officially, correct. However, overlapping inputs actually are loaded and monitored. It's just that if there are multiple inputs that include a file path, it is can be difficult to determine which clause is applied to a given file, especially if the clauses involve wildcards or whitelists.