I previously was running 4.1.7 with all WMI inputs disabled.
Now, since upgrading to 4.2, "WMI:LocalNetwork" data indexing has started and logs thousands of events per hour although related data inputs are disabled!!!
How can I fix that irritating problem???
Many Thanks in advance
While this bug is being addressed, I was able to forcibly stop this unwanted indexing by creating the following file then restarting the splunkd service:
disabled = 1
View solution in original post