Hello, I am trying to blacklist EventCode 5152 in inputs.conf. I have tried putting it in a different order in the list below (blacklist, blacklist3, blacklist5), and that didn't work. I have tried with the current message setting as well as typing out the message and that did not help. The other events listed are currently being blocked correctly. My current version of Splunk is 7.0.0. Any help would be appreciated. From the inputs.conf file: [WinEventLog://Security] disabled = 0 start_from = oldest current_only = 0 evt_resolve_ad_obj = 1 checkpointInterval = 5 index = wineventlog blacklist = EventCode="5152" Message="*" blacklist1 = EventCode="4662" Message="Object Type:(?!\s*groupPolicyContainer)" blacklist2 = EventCode="566" Message="Object Type:(?!\s*groupPolicyContainer)" blacklist3 = EventCode="4932" Message="*" blacklist4 = EventCode="4933" Message="*" From Splunk search 11/29/2018 01:44:20 PM LogName=Security SourceName=Microsoft Windows security auditing. EventCode=5152 EventType=0 Type=Information ComputerName=XXX.northgrum.com TaskCategory=Filtering Platform Packet Drop OpCode=Info RecordNumber=36423970 Keywords=Audit Failure Message=The Windows Filtering Platform has blocked a packet. Application Information: Process ID: 0 Application Name: - Network Information: Direction: Inbound Source Address: XXX Source Port: 8080 Destination Address: XXX Destination Port: 64430 Protocol: 6 Filter Information: Filter Run-Time ID: 70679 Layer Name: Transport Layer Run-Time ID: 13 EventCode = 5152 host = XXX source = WinEventLog:Security sourcetype = WinEventLog:Security ... View more