whitelist

noun

A filtering rule that includes one or more members in a set. For example, you can use whitelist rules to tell Splunk which files to consume when monitoring directories. If a file is whitelisted, Splunk consumes it and ignores all other files in the set. You specify whitelist rules for file monitoring when configuring your data inputs — either through the Splunk Web Manager or by editing the inputs.conf file.

Splunk allows whitelists for other filtering needs as well. For example, you can use whitelists with the Splunk deployment server, in the serverclass.conf file, to filter deployment clients.

The whitelist rule stands in contrast to the blacklist rule, which tells Splunk which members of a set to exclude. Blacklist and whitelist rules can be combined, for interesting results.

For more information

In the Getting Data In Manual:

• Whitelist or blacklist specific incoming data

In the Admin Manual:

• Configure event hashing

In the Distributed Deployment Manual:

• Define server classes

• Alphabetical
• By Topic