https://community.splunk.com/t5/Getting-Data-In/How-to-drop-single-host-s-single-event/m-p/658478#M111378 <P><a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/260836">@BoldKnowsNothin</a>&nbsp;- Yes, it can be done with inputs.conf on the UF under the App's local folder. (Most likely Windows Add-on will have this input.)</P><LI-CODE lang="markup">[Your input stanza that is collecting the data] blacklist5 = 4674</LI-CODE><P>&nbsp;</P><P>blacklist5, the number 5 could be different depending on what you are deploying.</P><P>&nbsp;</P><P>I hope this helps!! And welcome to the Splunk community!!!</P> Sat, 23 Sep 2023 13:21:24 GMT VatsalJagani 2023-09-23T13:21:24Z https://community.splunk.com/t5/Getting-Data-In/How-to-drop-single-host-s-single-event/m-p/658465#M111377 <P>Hello comrades,</P><P>We are using universal forwarder on hosts. And we have a noisy dude that products EventID:4674, and exceeds our license limit. Can we shut this dude's mouth on agent side but only on eventID:4674? Sorry newbie here.</P><P>Many thanks,</P> Sat, 23 Sep 2023 01:46:27 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-drop-single-host-s-single-event/m-p/658465#M111377 BoldKnowsNothin 2023-09-23T01:46:27Z https://community.splunk.com/t5/Getting-Data-In/How-to-drop-single-host-s-single-event/m-p/658478#M111378 <P><a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/260836">@BoldKnowsNothin</a>&nbsp;- Yes, it can be done with inputs.conf on the UF under the App's local folder. (Most likely Windows Add-on will have this input.)</P><LI-CODE lang="markup">[Your input stanza that is collecting the data] blacklist5 = 4674</LI-CODE><P>&nbsp;</P><P>blacklist5, the number 5 could be different depending on what you are deploying.</P><P>&nbsp;</P><P>I hope this helps!! And welcome to the Splunk community!!!</P> Sat, 23 Sep 2023 13:21:24 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-drop-single-host-s-single-event/m-p/658478#M111378 VatsalJagani 2023-09-23T13:21:24Z