Splunk Search

Can multiple wildcards be used in serverclass.conf whitelist

cloroxx
Explorer

Can multiple wildcards be used in serverclass.conf whitelist file? 

whitelist.from_pathname = /lookup/host.txt

 

Examples:

M*WEB*

*WBS*

 

Labels (2)
Tags (2)
0 Karma
1 Solution

_JP
Contributor

You should be able to, although it isn't called out in the docs for serverclass.conf directly.

There are a couple of other configuration parameters you can set to get a bit of logic in the matching, too, if that is helpful:

whitelist.where_field
whitelist.where_equals
blacklist.where_field
blacklist.where_equals

 

If you think the docs are unclear and should include a multiple wildcard example, then I suggest submitting feedback via the form at the bottom of every Splunk docs page.  That team has always been responsive for improving the documentation.

 

View solution in original post

0 Karma

cloroxx
Explorer

Thanks @_JP.  My goal was to account for servers in two data centers with identical names except the 2nd character which designates the datacenter and avoid having to maintain separate host files for each data center. I know the trailing wildcard works, I just wasn't sure if adding a wildcard at the beginning or in the middle would work. 

0 Karma

_JP
Contributor

You should be able to, although it isn't called out in the docs for serverclass.conf directly.

There are a couple of other configuration parameters you can set to get a bit of logic in the matching, too, if that is helpful:

whitelist.where_field
whitelist.where_equals
blacklist.where_field
blacklist.where_equals

 

If you think the docs are unclear and should include a multiple wildcard example, then I suggest submitting feedback via the form at the bottom of every Splunk docs page.  That team has always been responsive for improving the documentation.

 

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...