topic Re: TRANSFORMS-null = setnull in Splunk Enterprise

TRANSFORMS-null = setnull

gitingua — Wed, 10 Nov 2021 11:13:04 GMT

In props.conf, set the TRANSFORMS-null attribute:
```
[ActiveDirectory]
TRANSFORMS-null= setnull
```
Create a corresponding stanza in transforms.conf. Set DEST_KEY to "queue" and FORMAT to "nullQueue":
```
[setnull]
REGEX = \[ms_Mcs_AdmPwdExpirationTime\]
DEST_KEY = queue
FORMAT = nullQueue
```
Restart Splunk Enterprise.

field = ms_Mcs_AdmPwdExpirationTime
the values are still in the index
Not working. what did I indicate wrong?

Re: TRANSFORMS-null = setnull

richgalloway — Wed, 10 Nov 2021 13:25:18 GMT

There likely is an error in the regex, but to know that for sure we'll need to see some example data.

Re: TRANSFORMS-null = setnull

gitingua — Wed, 10 Nov 2021 21:21:32 GMT

@richgalloway

example

2Wc23q

C23gAwe3

Re: TRANSFORMS-null = setnull

richgalloway — Thu, 11 Nov 2021 13:40:16 GMT

There's the problem. The example data does not match the regex since none of them contain the string "ms_Mcs_AdmPwdExpirationTime". You'll have to find a regular expression that matches all expected strings you wish to send to the null queue.

Re: TRANSFORMS-null = setnull

gitingua — Thu, 11 Nov 2021 13:49:24 GMT

I was wrong. given string. "ms_Mcs_AdmPwd" there are random symbols of the unit and letters

@richgalloway

Re: TRANSFORMS-null = setnull

gitingua — Fri, 12 Nov 2021 01:12:04 GMT

@richgalloway

props.conf

[ActiveDirectory]

TRANSFORMS-null = setnull

transforms.conf

[setnull]

REGEX = ms-Mcs-AdmPwd\s*=(.*)

DEST_KEY = queue

FORMAT = nullQueue

not working

Re: TRANSFORMS-null = setnull

richgalloway — Fri, 12 Nov 2021 13:16:19 GMT

Again, to properly diagnose a regex problem we need to see the events that are to be matched. Not just a tiny snippet, either. Feel free to anonymize sensitive data.

Have you tested your regular expressions on a site like regex101.com?

Re: TRANSFORMS-null = setnull

gitingua — Fri, 12 Nov 2021 14:24:10 GMT

@richgalloway

yes. check in regex101. enable.

tried different regex methods working. now standing which is in the picture above