https://community.splunk.com/t5/Getting-Data-In/Windows-TA-input-blacklist-does-not-work-after-windows-update/m-p/583068#M102737 <P>Hi all,</P><P>after the last Windows update (JAN-2022) a windows_TA input blacklist filter for security logevents does not work anymore. before it worked fine. the black filter looks like this:</P><P>blacklist =EventCode="(4634|4672)" Message="Account\sName:\s+(?i)([\S+]+[\$]|serviceaccount1|serviceaccount2)"<BR />the blacklist should filter out computer accounts and other service accounts for certain eventcode.</P><P>has someone the same problem/ can someone help with that?</P><P>Thanks a lot</P> Mon, 31 Jan 2022 10:18:59 GMT Jil_com 2022-01-31T10:18:59Z https://community.splunk.com/t5/Getting-Data-In/Windows-TA-input-blacklist-does-not-work-after-windows-update/m-p/583068#M102737 <P>Hi all,</P><P>after the last Windows update (JAN-2022) a windows_TA input blacklist filter for security logevents does not work anymore. before it worked fine. the black filter looks like this:</P><P>blacklist =EventCode="(4634|4672)" Message="Account\sName:\s+(?i)([\S+]+[\$]|serviceaccount1|serviceaccount2)"<BR />the blacklist should filter out computer accounts and other service accounts for certain eventcode.</P><P>has someone the same problem/ can someone help with that?</P><P>Thanks a lot</P> Mon, 31 Jan 2022 10:18:59 GMT https://community.splunk.com/t5/Getting-Data-In/Windows-TA-input-blacklist-does-not-work-after-windows-update/m-p/583068#M102737 Jil_com 2022-01-31T10:18:59Z