I also think the document needs clarity. Based on the documentation appears, " is used for logical argument breaks: A single IPv4 or IPv6 address (examples: "10.1.2.3", "fe80::4a3") A CIDR block of addresses (examples: "10/8", "fe80:1234/32") A DNS name, possibly with a '*' used as a wildcard (examples: "myhost.example.com", "*.splunk.com") For example, "!10.1/16, *" will allow connections from everywhere except the 10.1.*.* network. However, it does not behave this way... Examples: acceptFrom = 10.1.1.1, 10.1.1.2, 10.1.1.3, 10.1.1.4 Only allows connection from 10.1.1.1, 10.1.1.2, 10.1.1.3, 10.1.1.4 Example: acceptFrom = "10.1.1.1, 10.1.1.2, 10.1.1.3, 10.1.1.4" Does not allow connections from 10.1.1.1, 10.1.1.2, 10.1.1.3, 10.1.1.4 Example: acceptFrom = "10.1.1.1", "10.1.1.2", "10.1.1.3", "10.1.1.4" Does not allow connections from 10.1.1.1, 10.1.1.2, 10.1.1.3, 10.1.1.4 I am using Splunk Enterprise 6.6.2 and have the rare opportunity to build from scratch in AWS, thus allow me test the settings thoroughly... ... View more