We have a managed service account that we use for Solarwinds. It is appearing in our logs a lot because it is used in NPM and SAM to get info from all of the systems in our domain for SolarWinds. Is there a way to exclude any logs containing that username from being forwarded?
i know that i can exclude an event id by placing a '-' in front of it. But i do not think it works the same way with the User field. If i enter "-MSA" into the "Users" field in Log Subscription it seems like the logs stop sending all together.