Splunk Search

Regex to find Account_Name's that end in a $ and \ isn't stopping it's special char nature

benbabich
Explorer

I want to find all names in Account_Name that end with a $ and not ones that don't. IE: I want NAME1$ but not NAME2.
I've been trying regex Account_Name=".*\$" but am still getting NAME2.
Any ideas?

Tags (2)
0 Karma

agarrison
Path Finder

You could try something like this Account_Name=\w+\$ to match account names that are letters, or something like Account_Name=.+\$ if your accounts have other characters.

For reference here is a transform I have that finds account names that match the computer name with a $ at the end and drop those events, I usually don't care about all the spam events from local accounts on the computer itself.

[ignorelocalaccount]
REGEX=(?msi)EventCode=(?:4624|4634).+^ComputerName=(\w+).+\s+Account\sName:\s+(\1\$)
DEST_KEY=queue
FORMAT=nullQueue

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Does the answer have to be regex? Have you tried ... | where Account_Name="*$" | ... ?

---
If this reply helps you, Karma would be appreciated.
0 Karma

benbabich
Explorer

I really wanted that to work. But where ".\$" in Regex still gives me names not ending in $, | where Account_Name="$" | gives me zero results.
I'll play around with it and see though.

0 Karma

nickhills
Ultra Champion
... user="*$"|table user

Works for me, but perhaps I have misunderstood exactly what you are asking!

...|rex field=user "(?<userDollar>.+\$)"|table user userDollar

also works, and creates a new field which will only include usernames ending with $

If my comment helps, please give it a thumbs up!
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...