@jconger Any chance this can be included in the add-on? I'm regularly dropping emails due to Microsoft's rate limiting. I have a powershell script doing something similar but would much rather leverage this app instead of something homegrown. ... View more

The best is to exclude the contents of a specific Event ID directly from the Universal Forwarder. Using a Heavy Forwarder for that is not necessary anymore. Create an app to deploy and in the inputs.conf you can create multiple whitelist matching different regex. So you can filter out specific messages or fields within a specific Event ID. whitelist = | key=regex [key=regex] https://docs.splunk.com/Documentation/Splunk/latest/Admin/Inputsconf , ... View more