Sorry for the thread necro, but I wanted to post a solution I developed today to this issue since I didn't find any examples of this anywhere else. The following negative regex lookahead excludes these 3 IP's as an example. It's very easy to modify for your own list. IP's excluded: 127.0.0.1, 192.168.0.1, 192.168.0.254 remoteAddress = ^(?!127\.0\.0\.1|192\.168\.0\.(1|254)).+$ Implemented today via the Splunk_TA_Windows inputs.conf on a test Windows universal forwarder. Seems to be doing the trick. ... View more