PowerShell Logging- Blacklist everything except Event Code 4104 & Level: Warning

[alyssasc]

We are attempting to ingest server powershell logging into Splunk. We found that ingest all the data was noisy and want to reduce the data ingested to what we really care about. Our goal is to only ingest Event Code 4104 with the level: Warning.

Is there a way to blacklist everything, and then whitelist only Event Code 4104 with the level: Warning?
We are ingesting via here: [WinEventLog://Microsoft-Windows-PowerShell/Operational]

[jdhunter]

inputs.conf - http://docs.splunk.com/Documentation/Splunk/latest/Admin/Inputsconf

Look at the Windows Event Log Monitor Section

Example from inputs.conf documentation:
whitelist = EventCode=%^200$% User=%jrodman%
Include events only if they have EventCode 200 and relate to User jrodman

Follow this pattern for your EventCode and Second Field you want to match