Getting Data In

Updating Splunk ServerClass Whitelist

joseph_caraccio
Engager

Hey Everyone,

Pretty sure this is a relatively easy problem to solve.. and it just has to do with my lack of REST knowledge.
Simply trying to update a list of server classes using this command

*curl -k -u {username}:{password} {url} -dwhitelist.0=server1 -dwhitelist.1=server2 -dwhitelist.3=server3 -dwhitelist.4=server4 -dwhitelist.5=server5 -dwhitelist.6=server6 -dwhitelist7=server7 -dwhitelist.8=server8 -dwhitelist.9=server9 -dwhitelist.10=server10 *

the problem with this command is that it takes what I set at whitelist.10 and puts in in between whitelist.1 and whitelist.3. I am guessing it just simply reads the first character of the server1 and places it there.

So I guess a simplified question is there some sort of end character for -dwhitelist.10 so that it ends up after whitelist.9?

Right now the order would be:
server1
server2
server10
server3
server4
server5
server6
server7
server8
server9

0 Karma

jeremiahc4
Builder

The whitelist ordering is not numeric so whitelist10 comes before whitelist2 (which you are missing in your problem statement).

0 Karma

jeremiahc4
Builder

it's sorted off the whitelist, not the servername

0 Karma
Get Updates on the Splunk Community!

Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...

 Prepare to elevate your security operations with the powerful upgrade to Splunk Enterprise Security 8.x! This ...

Get Early Access to AI Playbook Authoring: Apply for the Alpha Private Preview ...

Passionate about security automation? Apply now to our AI Playbook Authoring Alpha private preview ...

Reduce and Transform Your Firewall Data with Splunk Data Management

Managing high-volume firewall data has always been a challenge. Noisy events and verbose traffic logs often ...