In case of a conflict between a whitelist and a blacklist input setting, which one is used?

In case of a conflict between a whitelist and a blacklist input setting, which one is used?
A . Blacklist
B . Whitelist
C . They cancel each other out.
D . Whichever is entered into the configuration first.

View Answer

Answer: A

Explanation:

https://docs.splunk.com/Documentation/Splunk/8.0.4/Data/Whitelistorblacklistspecificincomingdat a

"It is not necessary to define both an allow list and a deny list in a configuration stanza. The settings are independent. If you do define both filters and a file matches them both, Splunk Enterprise does not index that file, as the blacklist filter overrides the whitelist filter." Source: https://docs.splunk.com/Documentation/Splunk/8.1.0/Data/Whitelistorblacklistspecificincomingdat a