https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-Splunk-getting-data-from-windows-servers/m-p/473805#M7326 <P>Hello,</P> <P>I want to blacklist the first four host to stop getting data from these servers, I have blacklisted them in the serverclass.conf, but still I am getting data on Splunk search head. please advise what is right way to block/stop the data to splunk, please note i dont want to unstall/stop splunk universal forwards in the server ( remote shost)</P> <P>[serverClass:ZU_All_windows_OS_member_servers_except_Exchange_servers]<BR /> blacklist.42 = WC-EMPSHARE<BR /> blacklist.43 = WC-STUSHARE<BR /> blacklist.45 = DC-EMPSHARE<BR /> blacklist.46 = DC-STUSHARE<BR /> whitelist.0 = SUHRODC02<BR /> whitelist.1 = MDPROD<BR /> whitelist.10 = KIWIK<BR /> whitelist.11 = WC-DXBADM-04<BR /> whitelist.12 = AEBFAPN01<BR /> whitelist.13 = GC-ADSS<BR /> whitelist.14 = GK-WEBFAPN02<BR /> whitelist.15 = MK-AUHADS2<BR /> whitelist.16 = LK-ZTEJ<BR /> whitelist.17 = DK-CSDXB07<BR /> whitelist.18 = LLBBZU</P> Wed, 30 Sep 2020 02:48:04 GMT kiranhar 2020-09-30T02:48:04Z https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-Splunk-getting-data-from-windows-servers/m-p/473805#M7326 <P>Hello,</P> <P>I want to blacklist the first four host to stop getting data from these servers, I have blacklisted them in the serverclass.conf, but still I am getting data on Splunk search head. please advise what is right way to block/stop the data to splunk, please note i dont want to unstall/stop splunk universal forwards in the server ( remote shost)</P> <P>[serverClass:ZU_All_windows_OS_member_servers_except_Exchange_servers]<BR /> blacklist.42 = WC-EMPSHARE<BR /> blacklist.43 = WC-STUSHARE<BR /> blacklist.45 = DC-EMPSHARE<BR /> blacklist.46 = DC-STUSHARE<BR /> whitelist.0 = SUHRODC02<BR /> whitelist.1 = MDPROD<BR /> whitelist.10 = KIWIK<BR /> whitelist.11 = WC-DXBADM-04<BR /> whitelist.12 = AEBFAPN01<BR /> whitelist.13 = GC-ADSS<BR /> whitelist.14 = GK-WEBFAPN02<BR /> whitelist.15 = MK-AUHADS2<BR /> whitelist.16 = LK-ZTEJ<BR /> whitelist.17 = DK-CSDXB07<BR /> whitelist.18 = LLBBZU</P> Wed, 30 Sep 2020 02:48:04 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-Splunk-getting-data-from-windows-servers/m-p/473805#M7326 kiranhar 2020-09-30T02:48:04Z https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-Splunk-getting-data-from-windows-servers/m-p/473806#M7327 <P>Have you checked from the Forwarder Management page on your Deployment Server whether those clients are indeed effectively no longer participating in that serverclass?<BR /> Have you confirmed on those respective servers that the respective inputs configuration has indeed been removed? Could there be some other configuration in place that still enables these inputs (e.g. in system local due to activating these inputs during UF install procedure)?</P> Thu, 31 Oct 2019 15:37:49 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-Splunk-getting-data-from-windows-servers/m-p/473806#M7327 FrankVl 2019-10-31T15:37:49Z https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-Splunk-getting-data-from-windows-servers/m-p/473807#M7328 <P>We don’t required these serve to forward the logs to Splunk ... my confirmation is working Splunk stop collecting the logs after making them blacklist but it some time to initiate configuration I believe... </P> Thu, 31 Oct 2019 15:42:43 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-Splunk-getting-data-from-windows-servers/m-p/473807#M7328 kiranhar 2019-10-31T15:42:43Z