Hi @kristian_kolb, If I create this in a specific app called e.g twistlock_parsing to remove events coming from host 127.0.0.1 only within a specific index e.g azure_twistlock - will this drop all events across all indexes containing that ip? I only want that IP address dropped in index azure_twistlock. I have already tried the solution from this page: https://community.splunk.com/t5/Getting-Data-In/How-to-blacklist-a-host-hosts-is-sending-logs-to-Splunk-via-TCP/m-p/289283 and it didn't work ... View more

Hi @mayurr98, I have done this, edited the transforms.conf and props.conf to exclude events coming from host 127.0.0.1 on heavy forwarders, restarted splunkd and it did not work. Any help? ... View more