Hi
How to edit props.conf and transforms.conf to exclude the windows events with event Codes 4634 at indexing time and Account_Name ending with $? Below is the sample event
Hi,
Why don't you try blacklist in inputs.conf if you are on universal forwarder?
[your stanza / what you are monitoring]
blacklist = 400
will ignore all 400 type errors
I recommend not using a regular expression.
<base search> NOT (EventCode="4634" OR Account_Name="*$")
If you're set on using regular expressions, try the following.
<base search>
| regex Account_Name!="\$$"
| regex EventCode!="4634"
Both searches assume you've extracted those fields. You can create a regular expression to search against the raw field, but I recommend searching against extracted fields.
If you want to go a step further, try mapping it to the Splunk CIM, and then searching against the CIM field names.
I want to ignore them at indexing time
@kiran331 Did you find the correct regex to blacklist Account name ending with $ at index time
I recommend changing your question title and summary to include the information from your comment, or you might get answers that don't address your situation.