-- I want to see events of 4648. I want to filter out certain ones. Is my stanza configured correctly?
\etc\system\local\inputs.conf
[WinEventLog://Security]
disabled = 0
whitelist = EventCode="4648"
blacklist = EventCode="4648" Message="Account\sWhose\sCredential\sWere\sUsed:\sAccount\sName:\s+computer01$"
blacklist = EventCode="4648" Message="Account\sWhose\sCredential\sWere\sUsed:\sAccount\sName:\s+Window Manger"
blacklist = EventCode="4648" Message="Account\sWhose\sCredential\sWere\sUsed:\sAccount\sName:\s+Font Driver Host"
-- Is there a Log that I can look at to troubleshoot my stanza?
