How can I black list event code and user type?

Getting Data In

I'm trying to blacklist the event code 4634 when user_type = computer. I'm using the below blacklist in my inputs.conf file and it doesn't seem to work. When I remove user_type="computer", it does properly filter out the event code 4634, but it doesn't work when I try the combination of the two. What am I doing wrong or is there a different way to accomplish this?

blacklist4 = EventCode="4634" user_type="computer"

Get Updates on the Splunk Community!

Deep Dive: Accelerate threat investigation with Splunk’s AI Assistant in Security

AI is one of the biggest topics in the market today, and for security teams, its value goes far beyond the ...

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...

Detection Engineering Office Hours: Real-World Troubleshooting & Q&A

[REGISTER HERE] This thread is for the Community Office Hours session on Detection Engineering Office Hours: ...