SPLK-1003 · Question #8
When configuring monitor inputs with whitelists or blacklists, what is the supported method of filtering the lists?
The correct answer is B. Regular expression. In Splunk's inputs.conf, the 'whitelist' and 'blacklist' stanzas under monitor inputs use regular expressions (regex) to match file names or paths. Wildcards alone are not supported for these filters. Administrators must write proper regex patterns (e.g., 'whitelist = .*\.log$' t
Question
When configuring monitor inputs with whitelists or blacklists, what is the supported method of filtering the lists?
Options
- ASlash notation
- BRegular expression
- CIrregular expression
- DWildcard-only expression
How the community answered
(22 responses)- A5% (1)
- B86% (19)
- D9% (2)
Explanation
In Splunk's inputs.conf, the 'whitelist' and 'blacklist' stanzas under monitor inputs use regular expressions (regex) to match file names or paths. Wildcards alone are not supported for these filters. Administrators must write proper regex patterns (e.g., 'whitelist = .*.log$' to match only .log files). This gives fine-grained control over which files are included or excluded from monitoring. 'Irregular expression' and 'slash notation' are not real Splunk concepts.
Topics
Community Discussion
No community discussion yet for this question.