Hello all, I am trying to filter out those noisy 4662 logs eating our license like anything as recommended in Splunk blogs and forums. Tried the below stanza for 4662 to blacklist everything except GPO related events, but not working as expected. Any help to fix the regex part. blacklist1 = EventCode="4662" Message="Object Type:(?!\s*groupPolicyContainer)" Raw Message is below :  Message=An operation was performed on an object. Subject : Security ID: $ Account Name: $ Account Domain:  Logon ID: 0x7F897031 Object: Object Server: DS Object Type: groupPolicyContainer Object Name: CN={123456-D64E-4013-ACC5-F78A}CN=Policies,CN=System,DC=xyz,DC=xyyz,DC=com Handle ID: 0x0 Operation: Operation Type: Object Access Accesses: Read Property Access Mask: 0x10 Properties: --- Public Information distinguishedName groupPolicyContainer Additional Information: Parameter 1: - Parameter 2: Can we filter directly based on Object_Type instead of Message field like :  blacklist1 = EventCode="4662" Object_Type="(x|y)".  Any help would be great! Thanks.   ... View more