blacklist

noun

A filtering rule that excludes one or more members from a set. For example, you can use blacklist rules to tell Splunk which files not to consume when monitoring directories. If a file is blacklisted, Splunk ignores it and consumes all other files in the set. You specify blacklist rules for file monitoring when configuring your data inputs — either through Splunk Manager or by editing the inputs.conf file.

Splunk allows blacklists for other filtering needs as well. For example, you can use blacklists with the Splunk deployment server, in the serverclass.conf file, to filter deployment clients.

The blacklist rule stands in contrast to the whitelist rule, which explicitly tells Splunk which members of a set to allow. Blacklist and whitelist rules can be combined, for interesting results.

For more information

In the Getting Data In Manual:

• Whitelist or blacklist specific incoming data

In the Admin Manual:

• Configure event hashing

In the Distributed Deployment Manual:

• Define server classes

• Alphabetical
• By Topic