topic Re: REGEX in blacklist doesn't work as intended in All Apps and Add-ons

REGEX in blacklist doesn't work as intended

osakachan — Tue, 13 Jul 2021 12:06:38 GMT

Hello folks,

I encountered a problem when trying to filter events from WinEventLog and EventCode 4662. When I use the next regex in a tester or in a SPL with a data set unfiltered, it works fine. But using it in a blacklist only allows a fraction of the messages when "Default Property Set" is in the first row after Properties.

blacklist9 = EventCode="4662" Message="(Tipo\sde\sobjeto:(?!\s*groupPolicyContainer))[\s\S]*(Propiedades:(?![\s\S]*Default Property Set))"

I tried some changes to the regex but I do not find a solution for this. Thanks for your time.

Re: REGEX in blacklist doesn't work as intended

codebuilder — Tue, 13 Jul 2021 15:38:46 GMT

Have you tried using erex to help build your regex? It's a hidden gem, and extremely useful.

https://docs.splunk.com/Documentation/Splunk/8.2.1/SearchReference/Erex

Re: REGEX in blacklist doesn't work as intended

venkatasri — Wed, 14 Jul 2021 01:26:40 GMT

@osakachan Can you check are you following allowed regex its little different from PCRE- inputs.conf - Splunk Documentation