***********$ (mean those events which are generated by system itself)..You can excluded all the $ contained user or choose different parameter as for exclusion.
Can you please explain more about this.
You can collect all $ containing destination and put them in exclusion filter with ! or choose another parameter like host,destination ip and so on..
Just create a regex for finding users ending with $ and set the NOT flag on the field.