In case of a conflict between a whitelist and a blacklist input setting, which one is used?

The correct answer is A. Blacklist. In Splunk, when a whitelist and blacklist conflict on the same input, the blacklist always takes precedence. This is a deny-first security principle: if an item is explicitly blocked (blacklisted), that denial overrides any allowance (whitelist). This prevents accidental data ing

Configuration Files

Question

Options

ABlacklist
BWhitelist
CThey cancel each other out.
DWhichever is entered into the configuration first.

How the community answered

(40 responses)

A
90% (36)
C
3% (1)
D
8% (3)

Explanation

In Splunk, when a whitelist and blacklist conflict on the same input, the blacklist always takes precedence. This is a deny-first security principle: if an item is explicitly blocked (blacklisted), that denial overrides any allowance (whitelist). This prevents accidental data ingestion of sensitive or unwanted sources even if they match a broad whitelist pattern.

Topics

#input settings#whitelist#blacklist#configuration precedence

Community Discussion

No community discussion yet for this question.

Full SPLK-1003 Practice