Splunk, filter events for some users but discard it if the event contain specific field

[angelo82]

i have configured transforms.conf like this:

[setnull]
REGEX = .
DEST_KEY = queue
FORMAT = nullQueue

[setparsing]
REGEX = (?i:\w*admin\w*)
DEST_KEY = queue
FORMAT = indexQueue

and is ok to filter all event contains "admin" field
how can i discard for this if, for example, the event contain the word "SeEnableDelegationPrivilege" or the event 672?

i need this because splunk is installed also on domain controller, and it is logging events for network and interactive logon done on the rest of servers which splunk is also installed, because of this, I have a lot of duplicates log, but i've found fields wich i can exclude to forward on splunk server

[angelo82 · Accepted solution]

any suggestion?