event 4663, removable storage.  The process information shows the process name to be d:\program files\splunk\bin\splunkd.exe Seems like anytime splunk fires off that process it logs a 4663 event.  The D drive is not a removable media device but is just a second disk in the system (vmdk) ... View more

Thanks for the reply, I would like to blacklist a security event that is coming from the splunk server (itself).  The main splunk database server is logging a particular event id that is useless and filling up an index.  I would like to blacklist that event.  I know the syntax for blacklisting, just not sure how (or where) to configure this for the splunk main server.  thanks in advance ... View more