Hi - I'm struggling with the syntax of this blacklist expression and would much appreciate some guidance from anybody that can help. What I'd like to do is blacklist all events other than EventCode=4740 which match the pattern Message=AccountName: *$".
I've been trying variations on the following expression without much success:
blacklist1 = EventCode="(?!4740)" Message="Account Name:[\s+](.\$)"
The 'Message' expression works fine - it's the 'EventCode' negative lookahead clause that I'm struggling with:
Thanks in advance for any suggestions you can provide.
... View more