https://community.splunk.com/t5/Splunk-Search/Account-deleted-query/m-p/572775#M199631 <P>I need to exclude the computer account ends with $, with the above query I am getting the result including computer account $. Can anyone please help me with this search query?</P> Thu, 28 Oct 2021 05:40:31 GMT cyber_Maddy 2021-10-28T05:40:31Z https://community.splunk.com/t5/Splunk-Search/Account-deleted-query/m-p/572392#M199494 <P>| datamodel "Change_Analysis" "Account_Management" search | where 'All_Changes.tag'="delete" AND 'All_Changes.user'!="*$*" | stats values(All_Changes.result) as "signature",values(All_Changes.src) as "src",values(All_Changes.dest) as "dest", values(All_Changes.user) as "users", DC(All_Changes.user) as user_count by "All_Changes.Account_Management.src_user" | rename "All_Changes.Account_Management.src_user" as "src_user","All_Changes.user" as "user"</P><P>&nbsp;</P><P>I am using this query to monitor&nbsp;&nbsp;for Account Deleted-&nbsp; But all the time I am getting this alert triggered for the computer account ending with $ symbol&nbsp;</P><P>Ex:&nbsp; XYZLAPTOP$ , ABCLAPTOP$&nbsp; etc</P><P>I have added the search&nbsp; where 'All_Changes.tag'="delete" AND 'All_Changes.user'!="*$*""</P><P>How can I exclude this $ symbol account from the report? Can any one please help&nbsp;&nbsp;</P><P>&nbsp;</P><P>&nbsp;</P> Tue, 26 Oct 2021 08:28:16 GMT https://community.splunk.com/t5/Splunk-Search/Account-deleted-query/m-p/572392#M199494 cyber_Maddy 2021-10-26T08:28:16Z https://community.splunk.com/t5/Splunk-Search/Account-deleted-query/m-p/572775#M199631 <P>I need to exclude the computer account ends with $, with the above query I am getting the result including computer account $. Can anyone please help me with this search query?</P> Thu, 28 Oct 2021 05:40:31 GMT https://community.splunk.com/t5/Splunk-Search/Account-deleted-query/m-p/572775#M199631 cyber_Maddy 2021-10-28T05:40:31Z