Let's back up a step... What do you want to accomplish by changing this filtering or what is not working that makes you want to change this without changing the values in the Splunk LDAP configuration as a solution?
I didn't mean to imply that you could use regular expressions here, but instead to call out the various parts of the message and label where I think they might be related to authentication.conf settings
... View more