Getting Data In

Excluding search results ending with a $ sign

kluey
Explorer

I am writing a Windows Security Log search for user accounts and have the eventID I need to search for but the results not only return user accounts, but also computer accounts ending with a $ sign. Ex., user= Win-w7dc008$ and user=jsmith. How do I get my search to ignore user accounts ending with a $ sign and only return user=jsmith?

This is what I am using with no luck.

NOT user=\"\w*\"

TIA

0 Karma
1 Solution

lguinn2
Legend

Try this

yoursearchhere
| regex user!="\$$"

View solution in original post

lguinn2
Legend

Try this

yoursearchhere
| regex user!="\$$"

kluey
Explorer

Worked perfectly. Thanks!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...