OK. I added an idea https://ideas.splunk.com/ideas/EID-I-2471 Feel free to upvote and/or comment ... View more

Needed three slashes as the second was cancelling out the end square bracket. But IT WORKED! Here's the full command that worked: | rex field=Caller_Process_Name "(?<process_name_short>[^\\\]+$)" This pulls out the program name part of the path and places it in a new field called process_name_short which I was able to run a stats command on to count up the different programs throwing audit fails. Thanks everyone! ... View more

This should work: account_name != "*$" ... View more