topic Re: blacklist regex help in Splunk Search

blacklist regex help

tkerr1357 — Wed, 16 Aug 2023 14:50:38 GMT

Hello all,

I am trying to blacklist an event that is tied to a specific sAMAccountName which is sAMAccountName="Alertz - ProductFeedback" . The only way I can think to achieve this is maybe with a blacklist regex statement but I am not sure and not very good with regex. Below is a sample event. Please let me know if there are any questions.

08/16/2023 09:34:07.541 dcName=RNBSAD1.rightnetworks.com admonEventType=Update Names: objectCategory=CN=Group,CN=Schema,CN=Configuration,DC=rightnetworks,DC=com name=Alertz - ProductFeedback distinguishedName=CN=Alertz - ProductFeedback,OU=Expired Alert Groups,OU=Desk Alerts,OU=Security Groups,DC=rightnetworks,DC=com cn=Alertz - ProductFeedback Object Details: sAMAccountType=268435456 sAMAccountName=Alertz - ProductFeedback objectSid=S-1-5-21-2605281412-2030159296-1019850961-856824 objectGUID=1e0bcfbf-dc8b-43e9-855a-7004ce3d6b3b whenChanged=09:33.53 AM, Wed 08/16/2023 whenCreated=09:31.41 AM, Tue 08/01/2023 objectClass=top|group Event Details: uSNChanged=820790490 uSNCreated=813674539 instanceType=4 Additional Details: dSCorePropagationData=16010101000000.0Z groupType=-2147483646

Re: blacklist regex help

richgalloway — Wed, 16 Aug 2023 20:04:22 GMT

What have you tried so far? Is the sAMAccuontName field already properly extracted (the complete value is present)?

Re: blacklist regex help

yuanliu — Fri, 18 Aug 2023 06:57:23 GMT

The difficult seems to be that default extraction will use pairdelim=" ". This ends up getting just "Alertz" in sAMAccountName.

There are any number of ways to overcome that depending on the exact problem you are trying to solve. Assuming by "blacklist" you mean to simply pick events with this sAMAccountName value from all events, the most efficient way is to put the criterion in index search itself.

<all other search criteria> "sAMAccountName=Alertz - ProductFeedback"

Hope this helps.