Can you help me filter out wineventlog eventcode 4656 account names in transforms.conf?

[ralphw_SAIC]

I am trying to figure out how to filter out account names that end in $ for the 4656 event codes. i am currently using the following in transforms.conf:

REGEX = (?ms)(.*EventCode=4656.*)(Subject:.*Account Name:(\s*\w+\$)
DEST_KEY = queue
FORMAT = nullQueue

I have tried multiple combinations of the above and it never filters out.

[splunkjas1 · Accepted solution]

This worked for me:

(?s)(EventCode=4656.*Account Name:[^\$]+\$)