topic Re: REGEX in transforms for windows path and EventCode in Splunk Search

REGEX in transforms for windows path and EventCode

gsawyer1 — Mon, 28 Sep 2020 12:50:22 GMT

Another awesome Regex question, related to windows. I have a windows EventCode=4663. The event contains a Process_Name field which Splunk extracts successfully on its own.
I want to write a transform to send events that match this EventCode AND a three different possible Process_Names, to send them to the nullqueue. Yes, that's two criteria in a transform.

Is this possible? What's the correct syntax?

Using Perl Editors for Regex online, versus using the regex command or rex command in Splunkweb, versus trying a REGEX in transform - they all seem to be slightly different in the rules you have to follow....
Here's an example of an eventcode 4663:

Log Name: Security

Source: Microsoft-Windows-Security-Auditing

Date: 11/9/2011 5:12:18 AM

Event ID: 4663

Task Category: File System

Level: Information

Keywords: Audit Success

User: N/A

Computer: dcc1.Logistics.corp

Description:
An attempt was made to access an object.

Subject:

Security ID: SYSTEM

Account Name: dcc1$

Account Domain: LOGISTICS

Logon ID: 0x3e7

Object:

Object Server: Security

Object Type: File

Object Name:

C:\Windows\servicing\Packages\Package_2_for_KB2620704~31bf3856ad364e35~x86~~6.0.1.0.mum

Handle ID: 0x530

Process Information:

Process ID: 0xc0c

Process Name:   C:\Windows\servicing\TrustedInstaller.exe

Access Request Information:

Accesses: WriteAttributes

Access Mask: 0x100

Re: REGEX in transforms for windows path and EventCode

JovanMilosevic — Tue, 20 Nov 2012 17:00:29 GMT

Hi,

Can't test this out myself at the mo, but have done something similar in the past.

Note, you have to escape the \'s and .'s in the process name, and proc 2 and proc 3 are the other processes you are trying to drop.

Give this a try

REGEX=(?msi)EventCode=4663.*Process\s+Name:\s+(C:\\Windows\\servicing\\TrustedInstaller\.exe|proc 2|proc 3)

DEST_KEY=queue

FORMAT=nullQueue

Re: REGEX in transforms for windows path and EventCode

gsawyer1 — Thu, 17 Oct 2013 15:18:24 GMT

Getting fairly good at this now, when I watch my syntax...magic ingredient is the following:

REGEX=(?msi)^EventCode=4663.+?Process\sName:\s+(C:\Windows\servicing\TrustedInstaller.exe|proc 2|proc 3)
DEST_KEY=queue
FORMAT=nullQueue

seems to work every time with this syntax....yay!!

Re: REGEX in transforms for windows path and EventCode

gsawyer1 — Thu, 17 Oct 2013 15:19:34 GMT

Splunk stripped out my backslashes before the s's in the above phrase....should occur after "process" and "Name:"....

Re: REGEX in transforms for windows path and EventCode

yannK — Fri, 25 Oct 2013 23:33:59 GMT

UPDATE splunk 6.*
Since this version you can actually specify a list or range of eventCodes to exclude at the forwarder level, in inputs.conf. It will reduce the volume at the forwarder level and reduce the network load.

see
http://docs.splunk.com/Documentation/Splunk/latest/Admin/Inputsconf

example:

[WinEventLog:Security]
disabled = 0
blacklist=566,800-850