Thanks Guys! A combination of both answers and a change to the props.conf (that i didn't share). This is the Regex string that worked: (?ms)(EventCode=4624).*(Account Name:.{5,30}\$) it was then also necessary to reverse the order in the prop.conf for the two transforms: they appear to be order specific. Define the blanket rule first, then exceptions after. "Keep everything except" appears to work, rather than drop this narrow list and keep this broad list [WinEventLog:Security] TRANSFORMS-Filter_4624 = Keep_4624,Drop_Some4624 There was then one other change I made, as I discovered there were some cases where events were logged with both "account name" fields populated the first with the $ on the end and the second with out, which were being dropped when i wanted them eg: 10/25/2017 09:18:41 AM LogName=Security SourceName=Microsoft Windows security auditing. EventCode=4624 EventType=0 Type=Information ComputerName=servername.emea.company.loc TaskCategory=Logon OpCode=Info RecordNumber=7206502 Keywords=Audit Success Message=An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: servername$ Account Domain: EMEA Logon ID: 0x3E7 Logon Type: 3 Impersonation Level: Impersonation New Logon: Security ID: S-1-5-x-8209345-y-z-a Account Name: account Account Domain: EMEA Logon ID: 0x809217BA Logon GUID: {00000000-0000-0000-0000-000000000000} So I finished up with: (?ms)(EventCode=4624).*(Account Name:).*(Account Name:.{5,30}\$) Thanks for your help and hope this solution helps others. ... View more

sorry for taking so long - I've only just got around to installing on the HF. It seems to have done the trick... the records are getting the right source type, and hence the log entries are now getting properly parsed up. Thanks! ... View more

That's the crux of the issue. There's nothing obvious to use. In fact characters within the value are reasonably being interpreted as the terminator. I either need to teach the Forcepoint Appliance how to write it's log better, or hope some Splunking Hero has figured out how to get Splunk to parse this better. Eric ... View more