Hi Gnanasekar, where ever blacklist can be used, it can be replaced with whitelist(vice versa is true as well) maybe, if you give us the config file, we can suggest how to do this. for example - assume there are two host names ABC.company.com and DEF.company.com [serverClass:all_apps_inputs] restartSplunkd = true blacklist.0 = splunk_indexers whitelist.0 = ABC* [serverClass:all_apps_inputs] restartSplunkd = true blacklist.0 = splunk_indexers blacklist.1 = DEF* ... View more

You should be connecting to splunkd, not splunkweb. By default that will be https://splunkserver:8089 ... View more