We have a requirement to write incoming debug messages to our rsyslog server, but not forward them on to our Splunk server. I have tried putting *.debug stop in front of our local rules, but that is not working. Any ideas how to prevent .debug messages from being forwarded.
I assume that you work with include config files. This makes order of processing very important. Details are in the rsyslog include documentation.
Based on this assumption I guess that you do the
*.debug stop at a place after the messages has already been forwarded.
Alternatively, you may use a very old version which does not understand
stop. In this case, you can do
*.debug ~, which is the very-old style equivalent.