While I'm familiar with how to exclude specific log types in PA from being sent to splunk (Threat, informational, etc) - when you say "There is a setting within PA that lets you exclude traffic from these searches..", is that what you are referring to? If not, any details on excluding specific traffic (ie we would like to exclude ipsec-to-lan and lan-to-ipsec traffic without using the nullQueue if possible. ... View more