I need to drop computer account name ending with $ sign
I need to drop computer account name ending with $ sign, the Drop function is not recognizing it any suggestion for alternate way of dropping all "computer-name$" ??
Answers
-
You're aware that the Drop function drops the whole event?
0 -
Yes, i want to drop such whole event meeting filter as shown in screenshot
0 -
Try to wrap the $ in double quotes
0 -
the problem is that the filter is not meeting --- i need to match with all Account_Name fields which ends with $ i.e. all computer account
0 -
i did the "$" did not work
0 -
Oh wait, Account_Name is not a string but a list
0 -
another observation is that Acccount_Name field has 2 values as shown in the first screenshot
0 -
Add a [0] after Account_Name
0 -
can you show me that with screenshot of the exact syntax
0 -
No, I'm on mobile phone
0 -
Do you want to remove the values that contain a $ at the end of the array element? What if the second value contains the $? Or are you looking to drop the entire event if any of the values in the array end with a $?
0 -
The Account_Name.includes('$') will simply check if $ exists anywhere in only the first item in the array, i.e. Account_Name[0]. What if it is Account_Name[1], etc.?
0 -
My understanding was that if the Account Name has a $, all values have it
0 -
Thought I would get fancy...
0 -
0 -
TIL about bind and !!
0 -
ChatGPT FTW!
0 -
Here Account_Name would have a `-` and `SETEST$`
0 -
I've checked some Windows events now. We see array with 2 Values on Specific events like 4703 where there is Account Name under 'Subject' and Under 'Target Account
0 -
the pack that transforms classic to JSON, puts both value under Account_Name
0 -
Yes, those are sample events I include with the pack, but some real events show that Account_Name can have two different values, and they are not always the same, sometimes one value is `-` and another ends with `$`, etc.
0 -
Yes
0
