https://community.splunk.com/t5/Getting-Data-In/What-is-wrong-with-my-inputs-conf-eventcode-blacklist/m-p/168299#M34061 <P>The issue here is that the EventCode=4662 needs to be surrounded by some sort of delimiter , per the following in inputs.conf </P> <P>In key/regex formn, the first character of the regex is the delimeter. Valid regexes look like:<BR /> %regex% <EM>regex</EM> "regex" etc. The only restriction is that the delimiter cannot be within the regex itself.</P> <P><A href="http://docs.splunk.com/Documentation/Splunk/6.1/Admin/Inputsconf">http://docs.splunk.com/Documentation/Splunk/6.1/Admin/Inputsconf</A></P> <P>So if you instead add a delimiter , EventCode="4662" this will resolve the issue</P> <P>blacklist1=EventCode="4662" Message=”Object Type:s+(?!groupPolicyContainer)”</P> <P>should work</P> Sat, 02 Aug 2014 00:25:38 GMT kserra_splunk 2014-08-02T00:25:38Z https://community.splunk.com/t5/Getting-Data-In/What-is-wrong-with-my-inputs-conf-eventcode-blacklist/m-p/168298#M34060 <P>I have setup the following inputs.conf stanza
:<BR /> <PRE><BR /> [WinEventLog://Security]
<BR /> disabled=0
<BR /> current_only=1
<BR /> blacklist1=EventCode=4662 Message=”Object Type:\s+(?!groupPolicyContainer)”<BR /> </PRE><BR /> but these events are still showing up in splunk when I search , what is the issue here?</P> <P>I am using windows universal forwarder 6.1.1 and the latest windows-TA</P> Sat, 02 Aug 2014 00:21:29 GMT https://community.splunk.com/t5/Getting-Data-In/What-is-wrong-with-my-inputs-conf-eventcode-blacklist/m-p/168298#M34060 splunkIT 2014-08-02T00:21:29Z https://community.splunk.com/t5/Getting-Data-In/What-is-wrong-with-my-inputs-conf-eventcode-blacklist/m-p/168299#M34061 <P>The issue here is that the EventCode=4662 needs to be surrounded by some sort of delimiter , per the following in inputs.conf </P> <P>In key/regex formn, the first character of the regex is the delimeter. Valid regexes look like:<BR /> %regex% <EM>regex</EM> "regex" etc. The only restriction is that the delimiter cannot be within the regex itself.</P> <P><A href="http://docs.splunk.com/Documentation/Splunk/6.1/Admin/Inputsconf">http://docs.splunk.com/Documentation/Splunk/6.1/Admin/Inputsconf</A></P> <P>So if you instead add a delimiter , EventCode="4662" this will resolve the issue</P> <P>blacklist1=EventCode="4662" Message=”Object Type:s+(?!groupPolicyContainer)”</P> <P>should work</P> Sat, 02 Aug 2014 00:25:38 GMT https://community.splunk.com/t5/Getting-Data-In/What-is-wrong-with-my-inputs-conf-eventcode-blacklist/m-p/168299#M34061 kserra_splunk 2014-08-02T00:25:38Z https://community.splunk.com/t5/Getting-Data-In/What-is-wrong-with-my-inputs-conf-eventcode-blacklist/m-p/168300#M34062 <P>Thanks bro. That did it for me.</P> Sat, 02 Aug 2014 00:33:47 GMT https://community.splunk.com/t5/Getting-Data-In/What-is-wrong-with-my-inputs-conf-eventcode-blacklist/m-p/168300#M34062 splunkIT 2014-08-02T00:33:47Z