We have recently turned on journaling within MS Exchange which basically sends a copy of every item to a journaling mail box. We know the email address the process uses and this appears in the message tracking logs as additional emails - in short journaling has doubled our Splunk licence usage!!
We would like to exclude the journaling email address from being indexed.
Exchange can't turn off message tracking for certain email addresses
We are using UF on the Exchange servers with a load balanced intermediate level of Heavy forwarders.
We have tried to apply the exclusion based on this answer - Answer 289736 - how to exclude a sourcetype from being indexed, but using a regex that picks up the journaling email address.
Thanks Giuseppe, I had found the docs you highlighted but they are about including the ones that match the regex and discard the rest, we are trying to do the other way round, discard those that match, index the rest.
I've also tried the different combinations of the regex you suggested on both the intermediate HF and the indexer.
Sill no luck 😞