Can ingestion be restricted to only one server in a server class

[timrich66]

I have a common file that appears on multiple servers in a server class. This results in duplicated events. I need to have all servers in the server class because they have other files that are unique. Is there a way to restrict the ingestion of the common file to only come from one of the servers?

I hope this makes sense 🙂

Thanks in advance.

[gcusello]

Hi @timrich66,
you have two ways:
create a special ServerClass for this server.

Send to nullqueue all the events of that sourcetype that arrive from the other servers.

I think that the first solution is the most easy and efficient!

Ciao.
Giuseppe