Stop logs forwarding logs from the universal forwarder to an indexer

[So76]

How do I stop my indexer consuming logs from a universal forwarder that was decommissioned. We did not remove the UF from the host before we gave the device away. It is no more connecting to the Deployment Server. Can null queue work?

Host = frontwave

source=WinEventLog:Security, WinEventLog:Application

index=winder

[SinghK]

Are you sure the server was decommed? And are you sure it's not the same server may be they freed up the IP and reassigned it to a new server? 

[PickleRick]

Well, what do you mean "gave it away"? It's out of your control and can still connect to your splunk infrastructure? That's not a good security practice 😉

I'd start at network level and simply drop the connections on firewall. Rerouting to nullqueue should work, but why bother with processing data from such unit at all?