How to Splunk getting data from windows servers

[kiranhar]

Hello,

I want to blacklist the first four host to stop getting data from these servers, I have blacklisted them in the serverclass.conf, but still I am getting data on Splunk search head. please advise what is right way to block/stop the data to splunk, please note i dont want to unstall/stop splunk universal forwards in the server ( remote shost)

[serverClass:ZU_All_windows_OS_member_servers_except_Exchange_servers]
blacklist.42 = WC-EMPSHARE
blacklist.43 = WC-STUSHARE
blacklist.45 = DC-EMPSHARE
blacklist.46 = DC-STUSHARE
whitelist.0 = SUHRODC02
whitelist.1 = MDPROD
whitelist.10 = KIWIK
whitelist.11 = WC-DXBADM-04
whitelist.12 = AEBFAPN01
whitelist.13 = GC-ADSS
whitelist.14 = GK-WEBFAPN02
whitelist.15 = MK-AUHADS2
whitelist.16 = LK-ZTEJ
whitelist.17 = DK-CSDXB07
whitelist.18 = LLBBZU

[FrankVl]

Have you checked from the Forwarder Management page on your Deployment Server whether those clients are indeed effectively no longer participating in that serverclass?
Have you confirmed on those respective servers that the respective inputs configuration has indeed been removed? Could there be some other configuration in place that still enables these inputs (e.g. in system local due to activating these inputs during UF install procedure)?

[kiranhar]

We don’t required these serve to forward the logs to Splunk ... my confirmation is working Splunk stop collecting the logs after making them blacklist but it some time to initiate configuration I believe...