Hey there.. Not sure if you're managing your forwarders through the Deployment Server or not, but in either scenario, setting the state of the app to disabled in it's app.conf will disable the app. state = disabled | enabled That said, in order for your forwarder to pick up that change, you must restart it. If you are using the Deployment Server, you should either comment out the app from being sent, or blacklist the machine from the stanza that ships the app. By doing so, you will guarantee that the data will not be monitored at all, and therefore not sent to your indexers. Another option would be to comment out the stanza in your inputs.conf to prevent it from being monitored, and then restart the forwarder. Hope that helps! ... View more