Hi all, Have a distributed Splunk Enterprise deployment. I am trying to filter incoming registry events to remove wasteful data on all of my Forwarders. This is the Stanza in question from $SPLUNK_HOME\etc\deployment_apps\Splunk_TA_Windows\local\inputs.conf. This app is deployed to all appropriate Forwarders and have run 'reload deploy-server' after saving changes. [WinRegMon://hklm] disabled = 0 hive = \\REGISTRY\\MACHINE\\.* proc = ^(?:(?!first\.exe|Second\.Punctuated\.exe).)*$ type = create|delete index = windows-mon  When watching incoming data, the regex isn't working, events containing these exe names in process_image are still present. I have checked using regex101.com using example data below, it works perfectly. 06/11/2020 08:51:57.983 event_status="(0)The operation completed successfully." pid=1996 process_image="c:\Program Files\Folder\first.exe" registry_type="CreateKey" key_path="HKLM\software\folder\classifiedapplications" data_type="REG_NONE" data="" 06/11/2020 08:53:18.187 event_status="(0)The operation completed successfully." pid=2084 process_image="c:\Program Files (x86)\Folder\Second.Punctuated.exe" registry_type="CreateKey" key_path="HKLM\software\microsoft\enterprisecertificates\trust\ctls" data_type="REG_NONE" data=""  What am I doing wrong? ... View more