I am trying to filter the windows event based on the Application Name and EventCode. Application_name I am trying to blacklist are splunkd.exe & zabbix_agentd.exe  EventCode: 5156 & 5158 Sample Event:  06/18/2020 10:00:28 PM LogName=Security SourceName=Microsoft Windows security auditing. EventCode=5156 EventType=0 Type=Information ComputerName=GURUABC.ad.xyz.com TaskCategory=Filtering Platform Connection OpCode=Info RecordNumber=1759943456 Keywords=Audit Success Message=The Windows Filtering Platform has permitted a connection. Application Information: Process ID: 8873 Application Name: \device\harddiskvolume2\program files\splunkuniversalforwarder\bin\splunkd.exe Network Information: Direction: Outbound Source Address: 112.31.122.191 Source Port: 49346 Destination Address: 11.213.158.112 Destination Port: 8089 Protocol: 6 Filter Information: Filter Run-Time ID: 66887 Layer Name: Connect Layer Run-Time ID: 87 Inputs.conf on UF: [WinEventLog://Security] disabled = 0 start_from = oldest current_only = 0 evt_resolve_ad_obj = 1 checkpointInterval = 5 I have tried the following different different blacklisting options under inputs.conf UF. # Option 1: blacklist1=EventCode="5156" Message=”Application Name:\s(?\device\harddiskvolume2\program files\zabbix agent\zabbix_agentd.exe)” blacklist2=EventCode="5156" Message=”Application Name:\s(?\device\harddiskvolume2\program files\splunkuniversalforwarder\bin\splunkd.exe)” blacklist3=EventCode="5158" Message=”Application Name:\s(?\device\harddiskvolume2\program files\zabbix agent\zabbix_agentd.exe)” blacklist4=EventCode="5158" Message=”Application Name:\s(?\device\harddiskvolume2\program files\splunkuniversalforwarder\bin\splunkd.exe)” # Option 2: blacklist1=EventCode="5156" ”Application\sName:\s(?\device\harddiskvolume3\program files\splunkuniversalforwarder\bin\splunkd.exe)" blacklist2=EventCode="5158" ”Application\sName:\s(?\device\harddiskvolume3\program files\splunkuniversalforwarder\bin\splunkd.exe)" # Option 3: blacklist1=EventCode=%^5158$% Message=%*zabbix_agentd.exe% blacklist2=EventCode=%^5158$% Message=%*splunkd.exe% # Option 4: blacklist1=EventCode=%^5156$% Application Name=%(*\bin\splunkd.exe|*\zabbix_agentd.exe)% blacklist2=EventCode=%^5158$% Application Name=%(*\bin\splunkd.exe|*\zabbix_agentd.exe)% # Option 5: blacklist1 = EventCode="5156" Application Name:"(*splunkd.exe|*zabbix_agentd.exe)" blacklist2 = EventCode="5158" Application Name:"(*splunkd.exe|*zabbix_agentd.exe)" # Option 6: [WinEventLog://Security] blacklist1=EventCode="5156" Message="Workstation Name:\s+*zabbix_agentd.exe*" blacklist2=EventCode="5158" Message="Application Name:\s+*zabbix_agentd.exe*" # Option 7: I have tried following under props & transforms on HF for routing the data to null queue. On HF : In props.conf, [WinEventLog] TRANSFORMS-null= setnull In transforms.conf [setnull] REGEX = (?s)EventCode=(5156|5158).*Application Name:\s.device.*\\splunkd.exe DEST_KEY = queue FORMAT = nullQueue Unfortunately non of the above is working. Please suggest. Thanks in advance. ... View more