How can I black list event code and user type?

Getting Data In

I'm trying to blacklist the event code 4634 when user_type = computer. I'm using the below blacklist in my inputs.conf file and it doesn't seem to work. When I remove user_type="computer", it does properly filter out the event code 4634, but it doesn't work when I try the combination of the two. What am I doing wrong or is there a different way to accomplish this?

blacklist4 = EventCode="4634" user_type="computer"

Get Updates on the Splunk Community!

Data Outage Monitoring and Reporting

We’ve all been there, right? Living our best life, working on our Splunk environment, when out of nowhere a ...

Manage Datasets and Connections in Catalog on Splunk Cloud Platform

Set Up Data Where You Use It Catalog already helps teams find and understand data across Splunk indexes, ...

Persistent Queue at TcpOut — One of Splunk's Most Practical Features

Splunk introduced persistent queueing at the tcpout layer as one of the most practical resilience features in ...