https://community.splunk.com/t5/Getting-Data-In/How-can-I-black-list-event-code-and-user-type/m-p/625358#M107482 <P>I'm trying to blacklist the event code 4634 when user_type = computer.&nbsp; I'm using the below blacklist in my inputs.conf file and it doesn't seem to work.&nbsp; When I remove user_type="computer", it does properly filter out the event code 4634, but it doesn't work when I try the combination of the two.&nbsp; What am I doing wrong or is there a different way to accomplish this?</P> <P>&nbsp;</P> <P>blacklist4 = EventCode="4634" user_type="computer"</P> Thu, 29 Dec 2022 04:18:38 GMT billf 2022-12-29T04:18:38Z https://community.splunk.com/t5/Getting-Data-In/How-can-I-black-list-event-code-and-user-type/m-p/625358#M107482 <P>I'm trying to blacklist the event code 4634 when user_type = computer.&nbsp; I'm using the below blacklist in my inputs.conf file and it doesn't seem to work.&nbsp; When I remove user_type="computer", it does properly filter out the event code 4634, but it doesn't work when I try the combination of the two.&nbsp; What am I doing wrong or is there a different way to accomplish this?</P> <P>&nbsp;</P> <P>blacklist4 = EventCode="4634" user_type="computer"</P> Thu, 29 Dec 2022 04:18:38 GMT https://community.splunk.com/t5/Getting-Data-In/How-can-I-black-list-event-code-and-user-type/m-p/625358#M107482 billf 2022-12-29T04:18:38Z