topic Re: Using regex to drop specific events in Splunk Search

Using regex to drop specific events

rdevine — Mon, 28 Sep 2020 11:28:06 GMT

i have an event that looks like this

03/01/2012 03:05:43 PM LogName=Security SourceName=Security EventCode=562 EventType=8 Type=Success Audit ComputerName=GLSSQLINT User=SYSTEM Sid=S-1-5-18 SidType=1 Category=3 CategoryString=Object Access RecordNumber=250015 Message=Handle Closed:

Object Server:  Security

Handle ID:  940

Process ID: 1288

Image File Name:    C:\Program Files\ISS\Proventia Server\phService.exe

I want these messages to be dropped if both type=success audit AND CategoryString=Object Access, however when i create the regex to do this which i think is supposed to be
(?m)(?=.*Type=Success Audit)(?=.*CategoryString=Object Access)
it doesn't seem to work. What am I doing wrong?

Re: Using regex to drop specific events

lguinn2 — Fri, 02 Mar 2012 02:24:56 GMT

I think that the following would do it. Not sure why you are using lookahead - it isn't needed here.

(?m)Type=Success Audit.*CategoryString=Object Access

Re: Using regex to drop specific events

rdevine — Fri, 02 Mar 2012 15:22:19 GMT

ultimately this worked.

(?ms)(?=Success\sAudit)(?=.*CategoryString=Object\sAccess)

Re: Using regex to drop specific events

rdevine — Fri, 02 Mar 2012 16:45:52 GMT

I tried this and it did not work.

Re: Using regex to drop specific events

lguinn2 — Fri, 02 Mar 2012 22:56:25 GMT

Good catch. You definitely needed the (?ms) not just the (?m)