my transform.conf
[setnull]
REGEX = .
DEST_KEY = queue
FORMAT = nullQueue
[setparsing]
REGEX =(?msi)^EventCode=4663.^Account Name:\s(?!.Administrator.)
DEST_KEY = queue
FORMAT = indexQueue
basically, I just want to index evencode is 4663 and don't want the account name is administrator.
I tried, but it doesn't work, anyone can help .. thanks
... View more