I have now tried pretty much all of the conbinations, including the one(s) above BUT if i put in the EventCode REGEX all is Hunky Dory and ANY changes made to the EventCode numbers are reflected in the indexing. However if I then remove the EventCode REGEX and insert the User REGEX (either your version above or my original version) into the SAME TRANSFORMS Stanza then Splunk in its wisdom still indexes all of the events with the User field ending in '$'. The MOST annoying thing is that if I do the following search:- source="WMI:WinEventLog:Security" | regex User="\$$" Then the results are all events with the User field ending in '$'. Is there any 'debugging' tools to see what Splunk is actually doing when it receives the event and makes the decision as to whether to either index it or not? ... View more

Sorry the copy/paste bit obviuosly did not work correctly the regex should read 'REGEX=(?m)^User=\$$' which i thought should be any "user value ending in '$'". I have tried changing this to what you suggested and it still has no affect. ... View more