Getting Data In
Highlighted

Can you help me filter out wineventlog eventcode 4656 account names in transforms.conf?

Path Finder

I am trying to figure out how to filter out account names that end in $ for the 4656 event codes. i am currently using the following in transforms.conf:

REGEX = (?ms)(.*EventCode=4656.*)(Subject:.*Account Name:(\s*\w+\$)
DEST_KEY = queue
FORMAT = nullQueue

I have tried multiple combinations of the above and it never filters out.

0 Karma
Highlighted

Re: Can you help me filter out wineventlog eventcode 4656 account names in transforms.conf?

Explorer

This worked for me:

(?s)(EventCode=4656.*Account Name:[^\$]+\$)

View solution in original post