On the universal forwarders, I need a regex pattern to drop Powershell temporary script events in splunk.  I'm trying to use the "Message" object to filter out the following example: Script Name = C:\\WINDOWS\\CCM\\SystemTemp\\1b71bac2-99a4-4075-a96e-9ecc803443f5.ps1 So far, my blacklist stanza is:   blacklist1 = EventCode = "4103" Message="C:\\\\WINDOWS\\\\CCM\\\\SystemTemp\\\\.*\.ps1" But this does not seem to work.  Help please!   ... View more