Transform at Index

baumerr — Sat, 08 Oct 2016 02:14:02 GMT

I am attempting to build a exporting field that ArcSight can use to properly categorize. Here what I got:

transform.conf
[devClassName]
REGEX = ($m)EventCode=(\d+)
FORMAT = devClassID::Microsoft-Windows-security-auditing:$1
WRITE_META = true

props.conf
[WinEventLog:Security]
TRANSFORMS-DevExtract = devClassName

fields.conf
[devClassID]
INDEXED = true

I need the result to be: Microsoft-Windows-security-auditing:4663 were as 4663 is pulled from EventCode in Splunk.

I have tried to build the transform just on my search forwarder, but it does not allow me to use the var $1

Re: Transform at Index

hunters_splunk — Sun, 09 Oct 2016 02:38:23 GMT

Hi baumerr,

Seems the regex in your [devClassName] stanza is incorrect. Should be:

REGEX = (?m)^EventCode=(\d+)

The (?m)^ in the REGEX indicates a multi-line event that starts with EventCode. Please try again using the suggested regex statement.

Hope it will work. Thanks!
Hunter