I recommend not using a regular expression.
<base search> NOT (EventCode="4634" OR Account_Name="*$")
If you're set on using regular expressions, try the following.
<base search> | regex Account_Name!="\$$" | regex EventCode!="4634"
Both searches assume you've extracted those fields. You can create a regular expression to search against the raw field, but I recommend searching against extracted fields.
If you want to go a step further, try mapping it to the Splunk CIM, and then searching against the CIM field names.
I recommend changing your question title and summary to include the information from your comment, or you might get answers that don't address your situation.
Why don't you try blacklist in inputs.conf if you are on universal forwarder?
[your stanza / what you are monitoring]
blacklist = 400
will ignore all 400 type errors