Transforms that send data to nullQueue work on a regex, so all you have to do is add a regex that will match both patterns. You're already doing that with 'setnull', as you're matching multiple event types. Just add another OR operator and match the pattern defined in 'setnullwindows'
REGEX = EventCode=(534|4776|4688|4672|4662|4634|4648|4907|4768|4696|5061|576|697|673|538|560|552)|(Account.Name:\W+.+\$)
I don't have a copy of your events, so I would suggest that you test to ensure the pattern works with a site like http://gskinner.com/RegExr/
Once you're done with that, you can just change props to refer to one transform instead of the two you have presently.
For instance, afterward it might look something like this:
props.conf
[WinEventLog:Security]
TRANSFORMS-null=setnull
EXTRACT-e1="SECID Account Name: (?P<SECID_account_name>\S+)"
EXTRACT-e2="(?<!SECID )Account Name: (?P<account_name>\S+)"
[WinEventLog:Security]
TRANSFORMS-null=setnull
transforms.conf:
[setnull]
REGEX= EventCode=(534|4776|4688|4672|4662|4634|4648|4907|4768|4696|5061|576|697|673|538|560|552)|(Account.Name:\W+.+\$)
DEST_KEY = queue
FORMAT = nullQueue
... View more