Yup, that would work too. Sysmon - Configuration Files  Sysmon - Event Filtering  ... View more

Is renderXml = 1 set on the input for working and non-working? And any chance what you have working locally includes delimiters around the regex?  Ex...  blacklist1 = $XmlRegex="(C:\\Program Files\\Preton\\PretonSaver\\PretonService.exe)" inputs.conf - Splunk Documentation * key=regex format: [...] * The regex consists of a leading delimiter, the regex expression, and a trailing delimiter. Examples: %regex%, *regex*, "regex" [...]   ... View more

Setting supportOctetCountedFraming="off" on the input fixes newlines being encoded to #012.   ... View more