Hello,
I currently have a Splunk universal forwarder on a few of my windows servers. The UF config is received by my Splunk deployment server. I have .exe processes that are currently utilizing much of my license and would like to disable Splunk from indexing those processes.
All .exe processes I want to ignore are in the c:\Program Files (x86)\Camera System Center 6\* subdirectory. I included * for all of them.
Would I just add something like below to the universal forwarder config file in the deployment server to achieve my goal?
(Pound sign here#) Disable Camera Process Monitoring
[monitor:c:\Program Files (x86)\Camera System Center 6\*]
disabled = 1
Thank you!
↧