https://community.splunk.com/t5/Getting-Data-In/Can-you-help-me-filter-out-wineventlog-eventcode-4656-account/m-p/399385#M71158 <P>This worked for me:</P> <PRE><CODE>(?s)(EventCode=4656.*Account Name:[^\$]+\$) </CODE></PRE> Tue, 25 Sep 2018 18:30:35 GMT splunkjas1 2018-09-25T18:30:35Z https://community.splunk.com/t5/Getting-Data-In/Can-you-help-me-filter-out-wineventlog-eventcode-4656-account/m-p/399384#M71157 <P>I am trying to figure out how to filter out account names that end in $ for the 4656 event codes. i am currently using the following in transforms.conf:</P> <PRE><CODE>REGEX = (?ms)(.*EventCode=4656.*)(Subject:.*Account Name:(\s*\w+\$) DEST_KEY = queue FORMAT = nullQueue </CODE></PRE> <P>I have tried multiple combinations of the above and it never filters out.</P> Tue, 25 Sep 2018 17:11:55 GMT https://community.splunk.com/t5/Getting-Data-In/Can-you-help-me-filter-out-wineventlog-eventcode-4656-account/m-p/399384#M71157 ralphw_SAIC 2018-09-25T17:11:55Z https://community.splunk.com/t5/Getting-Data-In/Can-you-help-me-filter-out-wineventlog-eventcode-4656-account/m-p/399385#M71158 <P>This worked for me:</P> <PRE><CODE>(?s)(EventCode=4656.*Account Name:[^\$]+\$) </CODE></PRE> Tue, 25 Sep 2018 18:30:35 GMT https://community.splunk.com/t5/Getting-Data-In/Can-you-help-me-filter-out-wineventlog-eventcode-4656-account/m-p/399385#M71158 splunkjas1 2018-09-25T18:30:35Z