topic Re: Multiple Eventcodes in same Blacklist in Getting Data In

Multiple Eventcodes in same Blacklist

helpmelearn — Tue, 14 Nov 2023 13:58:15 GMT

Hello

We are trying to change the below blacklists:

blacklist3 = EventCode="4690"
blacklist4 = EventCode="5145"
blacklist5 = EventCode="5156"
blacklist6 = EventCode="4658"
blacklist7 = EventCode="5158"

To a single blacklist with multiple eventcodes. We have tried:

blacklist3 = EventCode=5145,5156,4658,4690,5158

and

blacklist3 = EventCode="5145" OR "5156" OR "4658" OR "4690" OR "5158"

And none of these are applying and blocking out the event codes.

Any recommendations on how to get this to work?

richgalloway — Tue, 14 Nov 2023 14:17:11 GMT

The syntax is incorrect. A blacklist must be a comma-separated list of event IDs or pairs of key=regex specifiers. Try this

blacklist3 = 5145,5156,4658,4690,5158

helpmelearn — Tue, 14 Nov 2023 16:28:27 GMT

Thankyou! This worked 😄