The acceptFrom setting controls which remote hosts are allowed or denied for a network input. It supports IP addresses and CIDR notation. A deny rule is represented with an exclamation mark !.
To allow all hosts in the 10.0.0.0/8 network but deny hosts in the 10.1.0.0/16 network, the configuration must include both:
10.0.0.0/8 to allow the broader network
!10.1.0.0/16 to deny the excluded subnet
The best matching option is:
acceptFrom = !10.1.0.0/16, 10.0.0.0/8
Option A is incorrect because it only accepts the 10.1.0.0/16 network, which is the network that should be excluded.
Option B is incorrect because it accepts all 10.x.x.x hosts and does not exclude 10.1.x.x.
Option C is incorrect because it repeats the acceptFrom setting on separate lines. In Splunk configuration files, repeated attributes in the same stanza can override earlier values, so this is not the correct way to express the allow/deny list.
Option D is correct because it defines the exclusion and the allowed network in one acceptFrom list.
[Reference: Splunk Enterprise Admin Manual, inputs.conf specification; Splunk Enterprise Getting Data In Manual, network inputs and host access control settings., ===========]
