Splunk Search

Is there a regex available to drop service account events from active directory to be used on the universal forwarder?

hrithiktej
Communicator

Our security events count is in millions and we observed that we have more then 600 service accounts in our environment and they contribute millions of events for a/c log on events and hence we want to drop these events for service accounts.
Is there a regex available to drop service account events from active directory to be used on the universal forwarder?

Tags (2)
0 Karma
Get Updates on the Splunk Community!

Happy CX Day to our Community Superheroes!

Happy 10th Birthday CX Day!What is CX Day? It’s a global celebration recognizing innovation and success in the ...

Check out This Month’s Brand new Splunk Lantern Articles

Splunk Lantern is a customer success center providing advice from Splunk experts on valuable data insights, ...

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...