The best is to exclude the contents of a specific Event ID directly from the Universal Forwarder. Using a Heavy Forwarder for that is not necessary anymore. Create an app to deploy and in the inputs.conf you can create multiple whitelist matching different regex. So you can filter out specific messages or fields within a specific Event ID. whitelist = | key=regex [key=regex] https://docs.splunk.com/Documentation/Splunk/latest/Admin/Inputsconf , ... View more