Hi if someone could please help that would be great, I have events showing up in the indexer that are pushing me over my license, alot of it is useless to me information and i have been trying to wrap my head around filtering it out using regex but i just cant get my head around it.  Below is a typical event i would like to rid my indexer of, i cant just block all the events with 4634  as some of them are valid, but i would like to block all events where the "Targetusersid" is similar to DOMAIN\ABC-12345$   Can anyone help < Event xmlns= ' http://schemas.microsoft.com/win/2004/08/events/event '>< System >< Provider Name= ' Microsoft-Windows-Security-Auditing ' Guid= '{ 54849625-5478-4994-A5BA-3E3B0328C30D }' / >< EventID > 4634 < /EventID >< Version > 0 < /Version >< Level > 0 < /Level >< Task > 12545 < /Task >< Opcode > 0 < /Opcode >< Keywords > 0x8020000000000000 < /Keywords >< TimeCreated SystemTime= ' 2021-02-12T08:24:29.977950700Z ' / >< EventRecordID > 314243098 < /EventRecordID >< Correlation/ >< Execution ProcessID= ' 852 ' ThreadID= ' 12388 ' / >< Channel > Security < /Channel >< Computer >domaincontoller.domainname < /Computer >< Security/ >< /System >< EventData >< Data Name= ' TargetUserSid '> DomainName\machine-name$ < /Data >< Data Name= ' TargetUserName '>Machine-Name $ < /Data >< Data Name= ' TargetDomainName '> DomainName < /Data >< Data Name= ' TargetLogonId '> 0x22b9251d < /Data >< Data Name= ' LogonType '> 3 < /Data >< /EventData >< /Event> Props.conf  [XmlWinEventLog:Security] TRANSFORMS-xml = xmlnull REGEX=(?m)^EventCode="(4662|566)" Message="Object Type:(?!\s*groupPolicyContainer)" REGEX=(?m)^EventCode="(4656|4670|4663|4703|4658|4688)" Message="Account Name:(\W+\w+$)" REGEX=(?m)^EventCode="(4688|4689)" Message="%SplunkUniversalForwarder%" REGEX=(?m)^EventCode="6278" Message="Network Policy Server granted full access to a user because the host met the defined health policy." REGEX=(?m)^EventCode="(4624|4634|4627|4648)" Message="Account\sName:.*[\S\s]*Account\sName:\s+[\S+]+[\$]" Transforms.conf [xmlnull] REGEX= NO idea 😞 DEST_KEY = queue FORMAT = nullQueue   ... View more

Can someone tell me if when you change settings on a deployed app in your deployment server if the changes are propogated to the servers the app is deployed on or is there another step needed. ... View more

I have this search which shows the total of bytes coming in for a particular time period. Can someone tell me how to change the search so i can have the value changed to MB? I understand i should maybe be using the eval function but, try as i might, i can't seem to get the output i want. sourcetype="microsoft:forefront:tmg:proxy" | stats Sum(sc_bytes) ... View more