topic Re: Regex to filter security events does'nt work, need help in Splunk Search

Regex to filter security events does'nt work, need help

hrithiktej — Tue, 29 Sep 2020 16:11:05 GMT

Hi Guys,

We have UFs on our DCs and 2 indexers and on both indexers, to drop the unwanted text from events

I tried using the following regex in the /opt/splunk/etc/slave-apps/Splunk_TA_windows/local/props.conf

[WinEventLog:Security] SEDCMD-shortern4624 = SEDCMD-shortern4624 = s/(?mis)(.EventCode=4624.)This event is generated when a logon session.*$/\1/g

it does not work

Re: Regex to filter security events does'nt work, need help

somesoni2 — Thu, 05 Oct 2017 18:39:58 GMT

The SEDCMD is used for data masking (or in some cases editing) before indexing. For other log types you would, to drop the whole events which matches your regular expression, you would use Transforms (http://docs.splunk.com/Documentation/Splunk/6.5.2/Forwarding/Routeandfilterdatad#Discard_specific_events_and_keep_the_rest), but for Event Logs, you could just use blacklist attribute in inputs.conf on the Universal forwarder. See these

https://answers.splunk.com/answers/152131/filter-windows-eventcode-using-blacklist-and-whitelist.html
http://docs.splunk.com/Documentation/Splunk/7.0.0/Data/MonitorWindowseventlogdata#Create_advanced_filters_with_.27whitelist.27_and_.27blacklist.27

Re: Regex to filter security events does'nt work, need help

hrithiktej — Thu, 05 Oct 2017 19:02:55 GMT

I do not want to drop the whole event i just want to drop the static text that gives the description about the event.

I am referring to this link https://www.splunk.com/blog/2012/09/21/the-splunk-app-for-active-directory-and-how-i-tamed-the-security-log.html

Re: Regex to filter security events does'nt work, need help

somesoni2 — Thu, 05 Oct 2017 19:11:49 GMT

Ok.. Try this (props.conf on your indexer, you may have to deploy it from cluster master instead of updating the slave-apps directly)

[WinEventLog:Security] 
SEDCMD-shortern4624 = s/(?mis)(.*EventCode=4624.*)This event is generated when a logon session.*$/\1/g

Re: Regex to filter security events does'nt work, need help

hrithiktej — Tue, 29 Sep 2020 16:11:19 GMT

yes i am already following the best practice of doing this in master apps and then deploying to slave-apps

Thanks, i used a different regex and this time its working

NOW following is wat i am using in my /opt/splunk/etc/slave-apps/splunk-TA-Windows/local

in props.conf
# message shortener for windows event security
# removes text from message field starting with: This event is generated
[WinEventLog:Security]
TRANSFORM-windows_events = win_event_shortener

in transforms.conf

[win_event_shortener]
DEST_KEY = _raw
REGEX = ((.*+[\v])+)(?=This event is generated)
FORMAT = $1