Blacklist line not blacklisting events

[icewolf69]

Hi Everyone.  I'm expanding my blacklist and i'm having issues with a seemingly simple blacklist line.

Here is my current blacklist:

blacklist1 = EventCode="4688" Message="%%1936|%%1938|TokenElevationTypeDefault|TokenElevationTypeLimited"
blacklist2 = EventCode="4673|4674|5447|4656|4658|4664|4690|5379|4627"
blacklist3 = EventCode="4663|4660|4702|4762|4672|4799|4798|4670" Message="Security\sID:\s+NT\sAUTHORITY\SSYSTEM"
blacklist4 = Eventcode="4624" Message="Logon\sType:\s\t5"

So everything seems to work as expected for #1-3.   But when adding blacklist4, the forwarder doesn't seem to filter the event.  Searching in Splunk with the exact same regex is pulling up all the events I want to filter.  And the syntax seems to be exactly like blacklist3 that is working as intended.  Does anyone have any suggestions?

Thanks

[icewolf69]

I've tried a number of combinations thinking maybe it's something different between a search and the raw logs like:

blacklist4 = Eventcode="4624" Message="Logon\sType:[\s\t]*5"