Deployment Server - App deployment: remove file monitoring from splunk for single UF

[rchittip]

Hi,

I have a deployment server in my environment. We have an app exists "digitalApplication" targeting to index multiple files from UFs. This app targeted to all linux servers.

Since this app exists in all universal forwarder now, I have received a requirement to stop monitoring a File (Access.log) in one of the UF server. This states that "digitalApplication" exists in UF /etc/apps directory with Access.log.

Please note that app "digitalApplication" contains many other files from deployment server.

Now the question is, how to disable monitoring for Access.log in one single UF.

Thanks,
Ramu Chittiprolu

[Azeemering]

Normally I would say that you can blacklist a single UF / host in the serverclass configuration (Exclude (blacklist)
On the Deployment Server go to:
Settings->Forwarder Management-->Server Classes and edit the serverclass. Here you have the option to blacklist hosts.

But as you where saying that the app contains many more file monitors I would just create a new app and serverclass for that particular host.

Another possible solution would be to route and filter the specific data from that host to the Nullqueue:
https://docs.splunk.com/Documentation/Splunk/7.3.0/Forwarding/Routeandfilterdatad