topic Using regex and time to discard results? in Splunk Search

Using regex and time to discard results?

adrifs95 — Tue, 29 Nov 2022 15:26:44 GMT

Good morning,

I am trying to create a filter to avoid events where the user is 3 letters and 4 numbers (Not 0), f.e. FSA4568 and to avoid events at the time of entry to work for these users. I have created the filter for the user regex but I don't know how to integrate it with the time. The thing is that no events appear when the users have the structure of 3 letters plus four numbers and the time is between 7.30 and 9.30 a.m. How can I integrate it?

This is the search:

(index="anb_andorra" OR index="anb_luxembourg" OR index="anb_monaco" OR index="anb_espana") source="XmlWinEventLog:Security" ((EventCode IN (4771,4768) Error_Code=0x6) OR (EventCode=4625 Error_Code="0xc000006d")) user!="*$" src!="::ffff:*" | regex user!="([A-Z]{3}[1-9]{4})" | eval timestamp = _time*1000, name = signature

Re: Using regex and time to discard results

gcusello — Tue, 29 Nov 2022 15:01:41 GMT

Hi @adrifs95,

did you explored the time_hour and time_minute fields?

(index="anb_andorra" OR index="anb_luxembourg" OR index="anb_monaco" OR index="anb_espana") source="XmlWinEventLog:Security" ((EventCode IN (4771,4768) Error_Code=0x6) OR (EventCode=4625 Error_Code="0xc000006d")) user!="*$" src!="::ffff:*" ((time_hour>6 time_minute>29) (time_hour<10 time_minute<31)) | regex user!="([A-Z]{3}[1-9]{4})" | eval timestamp = _time*1000, name = signature

If you don't have them, you can extract them using strftime funtion.

Ciao.

Giuseppe

Re: Using regex and time to discard results

adrifs95 — Tue, 29 Nov 2022 15:13:10 GMT

Good,

Ok I'm going to try but the problem is that I want both conditions USER AND TIME at the same time so as the user is in a regex I don't know how to use it.

Re: Using regex and time to discard results

yuanliu — Tue, 29 Nov 2022 18:26:08 GMT

Random code blobs are not sufficient to illustrate what you want to solve. Always share sample data (anonymize as needed) and sample output from your code, then explain why the result is not what you expect.