https://community.splunk.com/t5/Getting-Data-In/Blacklist-format/m-p/495847#M84546 <P>-- I want to see events of 4648. I want to filter out certain ones. Is my stanza configured correctly?</P> <P>\etc\system\local\inputs.conf</P> <P>[WinEventLog://Security]<BR /> disabled = 0</P> <P>whitelist = EventCode="4648" </P> <P>blacklist = EventCode="4648" Message="Account\sWhose\sCredential\sWere\sUsed:\sAccount\sName:\s+computer01$"<BR /> blacklist = EventCode="4648" Message="Account\sWhose\sCredential\sWere\sUsed:\sAccount\sName:\s+Window Manger"<BR /> blacklist = EventCode="4648" Message="Account\sWhose\sCredential\sWere\sUsed:\sAccount\sName:\s+Font Driver Host"</P> <P>-- Is there a Log that I can look at to troubleshoot my stanza?</P> Fri, 24 Jan 2020 17:41:55 GMT sswigart 2020-01-24T17:41:55Z https://community.splunk.com/t5/Getting-Data-In/Blacklist-format/m-p/495847#M84546 <P>-- I want to see events of 4648. I want to filter out certain ones. Is my stanza configured correctly?</P> <P>\etc\system\local\inputs.conf</P> <P>[WinEventLog://Security]<BR /> disabled = 0</P> <P>whitelist = EventCode="4648" </P> <P>blacklist = EventCode="4648" Message="Account\sWhose\sCredential\sWere\sUsed:\sAccount\sName:\s+computer01$"<BR /> blacklist = EventCode="4648" Message="Account\sWhose\sCredential\sWere\sUsed:\sAccount\sName:\s+Window Manger"<BR /> blacklist = EventCode="4648" Message="Account\sWhose\sCredential\sWere\sUsed:\sAccount\sName:\s+Font Driver Host"</P> <P>-- Is there a Log that I can look at to troubleshoot my stanza?</P> Fri, 24 Jan 2020 17:41:55 GMT https://community.splunk.com/t5/Getting-Data-In/Blacklist-format/m-p/495847#M84546 sswigart 2020-01-24T17:41:55Z