https://community.splunk.com/t5/Getting-Data-In/How-to-blacklist-a-single-host-for-a-single-event/m-p/202180#M40016 <P>Try this</P> <P>On your Indexer/Heavy forwarder (node where data parsing happens), add this </P> <P>props.conf</P> <PRE><CODE>[host::yourchattyhostname] TRANSFORMS-remove4104=remove4104 </CODE></PRE> <P>transforms.conf</P> <PRE><CODE>[remove4104] REGEX=(?m)^EventCode=4104 *** DEST_KEY=queue FORMAT=nullQueue </CODE></PRE> Thu, 09 Jun 2016 18:36:17 GMT somesoni2 2016-06-09T18:36:17Z https://community.splunk.com/t5/Getting-Data-In/How-to-blacklist-a-single-host-for-a-single-event/m-p/202179#M40015 <P>I'm currently collecting Powershell event 4104 across all devices on the network and one sysadmin host has been found to be exceptionally chatty. I would like to blacklist event 4104 on that box while allowing it on all the rest. I've added the event id to the blacklist in the offending machine's etc/system/local/inputs.conf, as it should take precedence over the app's inputs.conf file, but I'm still receiving events. Can someone point me in the right direction?</P> Thu, 09 Jun 2016 18:17:02 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-blacklist-a-single-host-for-a-single-event/m-p/202179#M40015 knappra 2016-06-09T18:17:02Z https://community.splunk.com/t5/Getting-Data-In/How-to-blacklist-a-single-host-for-a-single-event/m-p/202180#M40016 <P>Try this</P> <P>On your Indexer/Heavy forwarder (node where data parsing happens), add this </P> <P>props.conf</P> <PRE><CODE>[host::yourchattyhostname] TRANSFORMS-remove4104=remove4104 </CODE></PRE> <P>transforms.conf</P> <PRE><CODE>[remove4104] REGEX=(?m)^EventCode=4104 *** DEST_KEY=queue FORMAT=nullQueue </CODE></PRE> Thu, 09 Jun 2016 18:36:17 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-blacklist-a-single-host-for-a-single-event/m-p/202180#M40016 somesoni2 2016-06-09T18:36:17Z