The default setting for the inputs.conf for the UF is a wildcard.  Change this to the default group in the local inputs.conf to override the setting. Pulled from the default inputs.conf for the UF: [monitor://$SPLUNK_HOME\var\log\splunk\splunkd.log]  _TCP_ROUTING = * index = _internal     [monitor://$SPLUNK_HOME\var\log\splunk\metrics.log]  _TCP_ROUTING = * index = _internal  Add it in the local inputs.conf  and change it to what ever the default group is on the outputs.conf, based on what was put in the thread appears to be group_a:   [monitor://$SPLUNK_HOME\var\log\splunk\splunkd.log]  _TCP_ROUTING = group_a index = _internal     [monitor://$SPLUNK_HOME\var\log\splunk\metrics.log]  _TCP_ROUTING = group_a index = _internal    This should eliminate the _internal logs from being forwarded to the 3rd Party system. ... View more