Splunk Search

How to use regex to filter out Windows events with Account names ending with $?

kiran331
Builder

Hi

How to edit props.conf and transforms.conf to exclude the windows events with event Codes 4634 at indexing time and Account_Name ending with $? Below is the sample eventalt text

0 Karma

Sukisen1981
Champion

Hi,

Why don't you try blacklist in inputs.conf if you are on universal forwarder?
[your stanza / what you are monitoring]
blacklist = 400
will ignore all 400 type errors

0 Karma

malvidin
Communicator

I recommend not using a regular expression.

<base search> NOT (EventCode="4634" OR Account_Name="*$")

If you're set on using regular expressions, try the following.

<base search>
| regex Account_Name!="\$$"
| regex EventCode!="4634"

Both searches assume you've extracted those fields. You can create a regular expression to search against the raw field, but I recommend searching against extracted fields.

If you want to go a step further, try mapping it to the Splunk CIM, and then searching against the CIM field names.

0 Karma

kiran331
Builder

I want to ignore them at indexing time

0 Karma

istutig
Loves-to-Learn Lots

@kiran331 Did you find the correct regex to blacklist Account name ending with $ at index time

0 Karma

malvidin
Communicator

I recommend changing your question title and summary to include the information from your comment, or you might get answers that don't address your situation.

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...