Getting Data In

Is there a way to use an external list file to whitelist or blacklist hosts in serverclass.conf?

Susannajuurinen
Explorer

Is there a way to use external lists with whitelist filtering? For example if I had systems A and B with several hosts, could I create a list like hosts.txt and then refer to that list and its content? Something like below:

whitelist.0 = hosts.txt systemB

hosts.txt
[systemA]
host1
host2

[systemB]
host3
host4

Thanks for any help!

0 Karma

regriffith
Path Finder

I use this for managing a large number of hosts. In one case I temporarily used it with up to a nine thousand host entries.

Entry in the serverclass.conf

[serverClass:specific_host]
whitelist.from_pathname = etc/system/local/host.txt
restartSplunkd = 1

lguinn2
Legend

AFAIK, you can't do that for serverclass.conf

0 Karma

Susannajuurinen
Explorer

Thanks Lisa,

Do you know if that kind of a feature is added to Splunk in the future? It would make managing the serverclass.conf (and other confs too) a lot more easier if hosts could be centrally grouped.

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...