Briang67 advice is a good start, but it might be a lot easier to actually do the nullQueueing on the indexer instead. It all depends on how data is gathered (UF, HF, WMI, Snare (or similar)). Also, with heavy forwarders you'd have a lot of remote configurations to consider, since you'd be doing the nullQueue filtering on each host generating data. If you are new to the product, you might not want to have to learn how to handle Deployment Server as well. The penalty for doing the nullQueue filtering on the indexer is that you'll have to transmit the data over the network before discarding it. However, if you currently have 500 MB in 9 hours, you probably have less than 5GB over a full day (since the load is probably not even throughout the day). 5GB of network traffic is not all that much, unless you have really slow links to travel. /Kristian ... View more