Hello,
I want to blacklist the first four host to stop getting data from these servers, I have blacklisted them in the serverclass.conf, but still I am getting data on Splunk search head. please advise what is right way to block/stop the data to splunk, please note i dont want to unstall/stop splunk universal forwards in the server ( remote shost)
[serverClass:ZU_All_windows_OS_member_servers_except_Exchange_servers]
blacklist.42 = WC-EMPSHARE
blacklist.43 = WC-STUSHARE
blacklist.45 = DC-EMPSHARE
blacklist.46 = DC-STUSHARE
whitelist.0 = SUHRODC02
whitelist.1 = MDPROD
whitelist.10 = KIWIK
whitelist.11 = WC-DXBADM-04
whitelist.12 = AEBFAPN01
whitelist.13 = GC-ADSS
whitelist.14 = GK-WEBFAPN02
whitelist.15 = MK-AUHADS2
whitelist.16 = LK-ZTEJ
whitelist.17 = DK-CSDXB07
whitelist.18 = LLBBZU
↧