https://community.splunk.com/t5/Getting-Data-In/Compound-Windows-blacklist/m-p/448824#M78005 <P>I am attempting to blacklist all Domain Controller events of a specific class on our domain controllers. While I have the blacklist working, it is doing it for all events for that user class - I want drop all successes while keeping any failures for troubleshooting.</P> <P>blacklist1 = EventCode="^(4624|4634|4648|4776)$" Message=".+(?i:bob)|.+(?i:joe)"</P> <P>I have tried the following with no success (pun unintented)</P> <P>blacklist1 = EventCode="^(4624|4634|4648|4776)$" Message=".+(?i:Audit Success).+(.+(?i:bob)|.+(?i:joe))"</P> <P>Any suggestions?</P> Mon, 18 Mar 2019 19:45:52 GMT thomas_sords_ct 2019-03-18T19:45:52Z https://community.splunk.com/t5/Getting-Data-In/Compound-Windows-blacklist/m-p/448824#M78005 <P>I am attempting to blacklist all Domain Controller events of a specific class on our domain controllers. While I have the blacklist working, it is doing it for all events for that user class - I want drop all successes while keeping any failures for troubleshooting.</P> <P>blacklist1 = EventCode="^(4624|4634|4648|4776)$" Message=".+(?i:bob)|.+(?i:joe)"</P> <P>I have tried the following with no success (pun unintented)</P> <P>blacklist1 = EventCode="^(4624|4634|4648|4776)$" Message=".+(?i:Audit Success).+(.+(?i:bob)|.+(?i:joe))"</P> <P>Any suggestions?</P> Mon, 18 Mar 2019 19:45:52 GMT https://community.splunk.com/t5/Getting-Data-In/Compound-Windows-blacklist/m-p/448824#M78005 thomas_sords_ct 2019-03-18T19:45:52Z