https://community.splunk.com/t5/Security/Filter-user-in-Security-log/m-p/34789#M13770 <P>Could you please provide some more information. My assumption is that you want to "hash" out the users rather than removing events involving certain users?</P> <P>What transforms are you using?</P> Wed, 14 Dec 2011 12:51:51 GMT MHibbin 2011-12-14T12:51:51Z https://community.splunk.com/t5/Security/Filter-user-in-Security-log/m-p/34788#M13769 <P>Hi,<BR /> How to import the security log excluding some users.<BR /> I tried with trasforms but to no avail.</P> <P>Thanks</P> Wed, 14 Dec 2011 11:10:27 GMT https://community.splunk.com/t5/Security/Filter-user-in-Security-log/m-p/34788#M13769 edoandria 2011-12-14T11:10:27Z https://community.splunk.com/t5/Security/Filter-user-in-Security-log/m-p/34789#M13770 <P>Could you please provide some more information. My assumption is that you want to "hash" out the users rather than removing events involving certain users?</P> <P>What transforms are you using?</P> Wed, 14 Dec 2011 12:51:51 GMT https://community.splunk.com/t5/Security/Filter-user-in-Security-log/m-p/34789#M13770 MHibbin 2011-12-14T12:51:51Z https://community.splunk.com/t5/Security/Filter-user-in-Security-log/m-p/34790#M13771 <P>for some events i have to exclude some users</P> <P>My trasforms is:</P> <P>[events-null]<BR /> REGEX=.<BR /> DEST_KEY=queue<BR /> FORMAT=nullQueue</P> <P>[security-filter]<BR /> REGEX=(?msi)^EventCode=(528|538|551|529|680|534|533|532|539|537|531|530|540|535|4624|4672|4648|4625|4634|4647|536)\D<BR /> DEST_KEY=queue<BR /> FORMAT=indexQueue</P> Wed, 14 Dec 2011 13:42:05 GMT https://community.splunk.com/t5/Security/Filter-user-in-Security-log/m-p/34790#M13771 edoandria 2011-12-14T13:42:05Z