https://community.splunk.com/t5/Getting-Data-In/Blacklisting-Account-Name-ftpadmin/m-p/263453#M50547 <P>I am trying to blacklist Windows service account named, ftpadmin from all servers. I tried:</P> <P>[WinEventLog://Security]<BR /> disabled = 0<BR /> start_from = oldest<BR /> current_only = 0<BR /> evt_resolve_ad_obj = 1<BR /> checkpointInterval = 5<BR /> blacklist1 = EventCode="4662" Message="Object Type:\s+(?!groupPolicyContainer)"<BR /> blacklist2 = EventCode="566" Message="Object Type:\s+(?!groupPolicyContainer)"</P> <H2>blacklist3 = Account_Name=ftpadmin</H2> <P>that did not work. so I tried by putting ftpadmin in quotation: </P> <H2>blacklist3 = Account_Name="ftpadmin"</H2> <P>but that did not work either. Could someone help please?<BR /> Thank you.</P> Tue, 29 Sep 2020 07:30:30 GMT nathanpyun 2020-09-29T07:30:30Z https://community.splunk.com/t5/Getting-Data-In/Blacklisting-Account-Name-ftpadmin/m-p/263453#M50547 <P>I am trying to blacklist Windows service account named, ftpadmin from all servers. I tried:</P> <P>[WinEventLog://Security]<BR /> disabled = 0<BR /> start_from = oldest<BR /> current_only = 0<BR /> evt_resolve_ad_obj = 1<BR /> checkpointInterval = 5<BR /> blacklist1 = EventCode="4662" Message="Object Type:\s+(?!groupPolicyContainer)"<BR /> blacklist2 = EventCode="566" Message="Object Type:\s+(?!groupPolicyContainer)"</P> <H2>blacklist3 = Account_Name=ftpadmin</H2> <P>that did not work. so I tried by putting ftpadmin in quotation: </P> <H2>blacklist3 = Account_Name="ftpadmin"</H2> <P>but that did not work either. Could someone help please?<BR /> Thank you.</P> Tue, 29 Sep 2020 07:30:30 GMT https://community.splunk.com/t5/Getting-Data-In/Blacklisting-Account-Name-ftpadmin/m-p/263453#M50547 nathanpyun 2020-09-29T07:30:30Z https://community.splunk.com/t5/Getting-Data-In/Blacklisting-Account-Name-ftpadmin/m-p/263454#M50548 <P>Hi Nathanpyun, There is a list of valid key names in the "Create advanced filters with 'whitelist' and 'blacklist'" section in this page : <A href="http://docs.splunk.com/Documentation/Splunk/6.2.0/Data/MonitorWindowsdata">http://docs.splunk.com/Documentation/Splunk/6.2.0/Data/MonitorWindowsdata</A></P> <P>It doesn't look like Account_Name is a valid key, and so I suspect that might be your issue. The "User" key might be what you are looking for. Please let me know if that helps!</P> Sat, 10 Oct 2015 01:31:28 GMT https://community.splunk.com/t5/Getting-Data-In/Blacklisting-Account-Name-ftpadmin/m-p/263454#M50548 muebel 2015-10-10T01:31:28Z