Hi All, We have an remote DC, to save bandwidth and Splunk license we like to filter out computer account logon messages. Using Splunk UFW 6.2.4 EventCode=4624 Example eventlog message: An account was successfully logged on. Subject: Security ID: NULL SID Account Name: - Account Domain: - Logon ID: 0x0 Logon Type: 3 New Logon: Security ID: NT AUTHORITY\SYSTEM Account Name: DC01$ Account Domain: AAA-BBB Logon ID: 0x2d71a99b Logon GUID: ....... Account Name is listed twice, if the second Account Name directive is an computer account (ending with a $) the event should be blacklisted and not forwarded to the indexer. I added the following to the inputs.conf in de deployment-apps/Splunk_TA_windows/local: blacklist3 = EventCode="4624" Message="Account\sName:\s.*Account\sName:\s(\S+\$)" Why is this not working? Tested the regex on https://regex101.com/ and it looks fine? Blacklisting just EventCode="4624" is working fine but that’s not what we want. Also tried the following, all not working while regex101 shows the regex is ok. blacklist3 = EventCode="4624" Message="(?:.*?Account Name:){2}\s(\S+)\$" blacklist3 = EventCode="4624" Message="Account Name:\s(\S+).+Account Name:\s(\S+)\$" blacklist3 = EventCode="4624" Message="Account\sName:.*Account\sName:\s[\S+]+[\$]" Thanks in advance, ... View more