This string is being sent from the F5 UDP monitor that you have assigned to the Splunk pool. You can stop it by removing the monitor from the pool but then you will not be alerted when the pool is not responding. By default the monitor is sent every 5 seconds which can be increased to whatever value you want it to be. If you do so then make sure you also increase the Timeout value as well. BTW, you should not change the default UDP monitor you should create a new one and use the default one as the parent. Obviously, that only reduces the events. What I did was: 1. Created a new udp time, udp_splunk. Increased the Interval to 60. Set Timeout to 181. Set Send String to "2020-01-01T01:01:01Z F5monitor" 2. Filtered out the monitor events using TRANSFORMS-null. Adding the hardcoded timestamp to the send string will eliminate the "failed to parse timestamp" errors. ... View more