https://community.splunk.com/t5/Getting-Data-In/Blacklist-sometimes-not-working/m-p/145563#M29667 <P>I have this in my windows DC server with Universal Forwarder v 6.1.1.<BR /> ..\Splunk_TA_Windows\local\inputs.conf file:</P> <P>[WinEventLog://Security]<BR /> disabled = 0<BR /> current_only=1<BR /> blacklist1=EventCode=4662 <BR /> blacklist2=EventCode=566</P> <P>Yet event 4662 gets indexed sometimes. Any idea? The event 4662 is generated around 1000+ per second. Is the forwarder not keeping up with this rate of events?</P> Mon, 28 Sep 2020 17:05:53 GMT tdewberry 2020-09-28T17:05:53Z https://community.splunk.com/t5/Getting-Data-In/Blacklist-sometimes-not-working/m-p/145563#M29667 <P>I have this in my windows DC server with Universal Forwarder v 6.1.1.<BR /> ..\Splunk_TA_Windows\local\inputs.conf file:</P> <P>[WinEventLog://Security]<BR /> disabled = 0<BR /> current_only=1<BR /> blacklist1=EventCode=4662 <BR /> blacklist2=EventCode=566</P> <P>Yet event 4662 gets indexed sometimes. Any idea? The event 4662 is generated around 1000+ per second. Is the forwarder not keeping up with this rate of events?</P> Mon, 28 Sep 2020 17:05:53 GMT https://community.splunk.com/t5/Getting-Data-In/Blacklist-sometimes-not-working/m-p/145563#M29667 tdewberry 2020-09-28T17:05:53Z https://community.splunk.com/t5/Getting-Data-In/Blacklist-sometimes-not-working/m-p/145564#M29668 <P>The issue here is that the blacklist requires delimiters around the regex in order for it to work. Try changing blacklist1=EventCode="4662" , for more detail please see the following post</P> <P><A href="http://answers.splunk.com/answers/148883/what-is-wrong-with-my-inputsconf-eventcode-blacklist">http://answers.splunk.com/answers/148883/what-is-wrong-with-my-inputsconf-eventcode-blacklist</A></P> Mon, 04 Aug 2014 17:33:47 GMT https://community.splunk.com/t5/Getting-Data-In/Blacklist-sometimes-not-working/m-p/145564#M29668 kserra_splunk 2014-08-04T17:33:47Z