Hi, when working on the indexer machine: how do I know if a specific configuration (like a input monitor stanza) is applied to the incoming events received from the remote UF or if it's applied to the local generated events ? how can I separate these settings ? Example: Indexer installed on Windows, I want to exclude event 4662 from localhost but not from the events received from UF. Are there two monitor defined ? Where ? What if I already applied a blacklist filtering on the UF? A second filtering will be again applied on the indexer ? Thanks ======================================= I suppose I didn't manage to express myself correctly. Let's try again: The splunk indexer is a role that is installed on a machine. The indexer is receiving logs from other machines called (most of the time) Universal Forwarders (UF) All the settings in props.conf and transforms.conf on the indexer are meant to be applied to the incoming logs in order to filter/change/reroute/index/drop/etc those logs/events from UF BUT the indexer is also a machine that is generating logs. Let's call them local logs. What settings are used to deal with the local logs ? Is there a inputs.conf for the local logs ? How can I filter local logs without interfering with the filtering of incoming logs from the UF ? Should I configure a UF on the indexer in order to inject logs into itself ? (that's nonsense, but for the sake of the comprehension) Is there a unique setting for all logs (incoming & local) ? /etc/system/local ? ... View more