How to I exclude $ in my searches

(Blason) #1

Hi guys,

I need to exclude whenever there is $ in TargetUserName:

Can someone please guide me how to?

I have following query

EventID:4624 AND NOT TargetUserName:(SYSTEM WINFGTDNS01$)
So would like to exclude all entries which has $ in it

(Anmol Sharma) #2

I am not very sure if this can work as expected in your use case but you can give a try querying like below:

EventID:4624 AND NOT TargetUserName:"*$*"

PS You need to cross check the validity of results obtained form the query above.

#3

if you use * at the beginning you should check and enable the graylog’s allow_leading_wildcard_searches option in server.conf

(system) #4

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.