Splunk search to filter mounts on windows machines?

[splunker_rmc]

Looking to write a search that filters mount drives. For example, the values for the field "mount" are "C:" "D:" "F" "harddiskvol1" "harddiskvol2" .... etc.

How can I write a search that returns events ONLY where the mount is a letter, i.e. "C:" "D:", etc. and excludes "harddiskvol1" or anything that does not follow "<letter>:"?

Thanks in advance.

[ITWhisperer · Accepted solution]

| where match(mount,"^\w:")

or

| where match(mount,"^[A-Z]:")