topic Re: How to use regex to filter out Windows events with Account names ending with $? in Splunk Search https://community.splunk.com/t5/Splunk-Search/How-to-use-regex-to-filter-out-Windows-events-with-Account-names/m-p/339573#M100701 <P>I recommend not using a regular expression.</P> <PRE><CODE>&lt;base search&gt; NOT (EventCode="4634" OR Account_Name="*$") </CODE></PRE> <P>If you're set on using regular expressions, try the following.</P> <PRE><CODE>&lt;base search&gt; | regex Account_Name!="\$$" | regex EventCode!="4634" </CODE></PRE> <P>Both searches assume you've extracted those fields. You can create a regular expression to search against the raw field, but I recommend searching against extracted fields.</P> <P>If you want to go a step further, try mapping it to the Splunk CIM, and then searching against the CIM field names.</P> Thu, 14 Sep 2017 21:32:33 GMT malvidin 2017-09-14T21:32:33Z How to use regex to filter out Windows events with Account names ending with $? https://community.splunk.com/t5/Splunk-Search/How-to-use-regex-to-filter-out-Windows-events-with-Account-names/m-p/339572#M100700 <P>Hi</P> <P>How to edit props.conf and transforms.conf to exclude the windows events with event Codes 4634 at indexing time and Account_Name ending with $? Below is the sample event<span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/3505i3FCAE228934A2531/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> Thu, 14 Sep 2017 21:14:43 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-regex-to-filter-out-Windows-events-with-Account-names/m-p/339572#M100700 kiran331 2017-09-14T21:14:43Z Re: How to use regex to filter out Windows events with Account names ending with $? https://community.splunk.com/t5/Splunk-Search/How-to-use-regex-to-filter-out-Windows-events-with-Account-names/m-p/339573#M100701 <P>I recommend not using a regular expression.</P> <PRE><CODE>&lt;base search&gt; NOT (EventCode="4634" OR Account_Name="*$") </CODE></PRE> <P>If you're set on using regular expressions, try the following.</P> <PRE><CODE>&lt;base search&gt; | regex Account_Name!="\$$" | regex EventCode!="4634" </CODE></PRE> <P>Both searches assume you've extracted those fields. You can create a regular expression to search against the raw field, but I recommend searching against extracted fields.</P> <P>If you want to go a step further, try mapping it to the Splunk CIM, and then searching against the CIM field names.</P> Thu, 14 Sep 2017 21:32:33 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-regex-to-filter-out-Windows-events-with-Account-names/m-p/339573#M100701 malvidin 2017-09-14T21:32:33Z Re: How to use regex to filter out Windows events with Account names ending with $? https://community.splunk.com/t5/Splunk-Search/How-to-use-regex-to-filter-out-Windows-events-with-Account-names/m-p/339574#M100702 <P>I want to ignore them at indexing time</P> Thu, 14 Sep 2017 21:33:40 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-regex-to-filter-out-Windows-events-with-Account-names/m-p/339574#M100702 kiran331 2017-09-14T21:33:40Z Re: How to use regex to filter out Windows events with Account names ending with $? https://community.splunk.com/t5/Splunk-Search/How-to-use-regex-to-filter-out-Windows-events-with-Account-names/m-p/339575#M100703 <P>I recommend changing your question title and summary to include the information from your comment, or you might get answers that don't address your situation.</P> Thu, 14 Sep 2017 21:51:52 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-regex-to-filter-out-Windows-events-with-Account-names/m-p/339575#M100703 malvidin 2017-09-14T21:51:52Z Re: How to use regex to filter out Windows events with Account names ending with $? https://community.splunk.com/t5/Splunk-Search/How-to-use-regex-to-filter-out-Windows-events-with-Account-names/m-p/339576#M100704 <P>Hi,</P> <P>Why don't you try blacklist in inputs.conf if you are on universal forwarder?<BR /> [your stanza / what you are monitoring]<BR /> blacklist = 400<BR /> will ignore all 400 type errors</P> Fri, 15 Sep 2017 17:06:58 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-regex-to-filter-out-Windows-events-with-Account-names/m-p/339576#M100704 Sukisen1981 2017-09-15T17:06:58Z Re: How to use regex to filter out Windows events with Account names ending with $? https://community.splunk.com/t5/Splunk-Search/How-to-use-regex-to-filter-out-Windows-events-with-Account-names/m-p/530173#M149794 <P><a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/168759">@kiran331</a>&nbsp;Did you find the correct regex to blacklist Account name ending with $ at index time</P> Fri, 20 Nov 2020 09:22:22 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-regex-to-filter-out-Windows-events-with-Account-names/m-p/530173#M149794 istutig 2020-11-20T09:22:22Z