I want to blacklist the first four host to stop getting data from these servers, I have blacklisted them in the serverclass.conf, but still I am getting data on Splunk search head. please advise what is right way to block/stop the data to splunk, please note i dont want to unstall/stop splunk universal forwards in the server ( remote shost)
Have you checked from the Forwarder Management page on your Deployment Server whether those clients are indeed effectively no longer participating in that serverclass?
Have you confirmed on those respective servers that the respective inputs configuration has indeed been removed? Could there be some other configuration in place that still enables these inputs (e.g. in system local due to activating these inputs during UF install procedure)?
We don’t required these serve to forward the logs to Splunk ... my confirmation is working Splunk stop collecting the logs after making them blacklist but it some time to initiate configuration I believe...