[global]
restartSplunkd = false

# ALL SEARCH HEADS
[serverClass:all_search]
whitelist.0 = my.searchhead.com
[serverClass:all_search:app:org_all_deploymentclient]
# Only used if pushing indexes from the search head to the indexers
# [serverClass:all_search:app:org_all_forwarder_outputs]

# ALL INDEXERS
[serverClass:all_indexer]
whitelist.0 = my.indexer.com
[serverClass:all_indexer:app:org_all_deploymentclient]

# ALL FORWARDERS
[serverClass:all_forwarder]
whitelist.0 = *
blacklist.0 = my.searchhead.com
blacklist.1 = my.indexer.com
restartSplunkd = true
[serverClass:all_forwarder:app:org_all_deploymentclient]
[serverClass:all_forwarder:app:org_all_forwarder_outputs]