I want to find all names in Account_Name that end with a $ and not ones that don't. IE: I want NAME1$ but not NAME2.
I've been trying regex Account_Name=".*\$" but am still getting NAME2.
Any ideas?
You could try something like this Account_Name=\w+\$ to match account names that are letters, or something like Account_Name=.+\$ if your accounts have other characters.
For reference here is a transform I have that finds account names that match the computer name with a $ at the end and drop those events, I usually don't care about all the spam events from local accounts on the computer itself.
[ignorelocalaccount]
REGEX=(?msi)EventCode=(?:4624|4634).+^ComputerName=(\w+).+\s+Account\sName:\s+(\1\$)
DEST_KEY=queue
FORMAT=nullQueue
Does the answer have to be regex? Have you tried ... | where Account_Name="*$" | ...
?
I really wanted that to work. But where ".\$" in Regex still gives me names not ending in $, | where Account_Name="$" | gives me zero results.
I'll play around with it and see though.
... user="*$"|table user
Works for me, but perhaps I have misunderstood exactly what you are asking!
...|rex field=user "(?<userDollar>.+\$)"|table user userDollar
also works, and creates a new field which will only include usernames ending with $