Hi,
I'm trying to filter out specific windows event log that's Id=0 😞
This is the event:
ERROR 2015-07-12 13:11:31,270 There is no security-data for the current context.. Occured in method:"Register", in process:"w3wp"
Stack trace:
at iFOREX.Security.Context.SecurityDataProvider.AssertExists() in d:\BuildAreas\RelFxnet3\FX3-81\Source\iFOREX Framework\iFOREX.Security\iFOREX.Security\Context\SecurityDataProvider.cs:line 26
at iFOREX.Clients.Web.Classes.AppGlobal.get_SecurityToken() in d:\BuildAreas\RelFxnet3\FX3-81\Source\iFOREX Framework\IFOREX.Clients\iFOREX.Clients.Web\BaseClasses\AppGlobal.cs:line 212
at iFOREX.Clients.Web.Common.Utils.SecurityHelper.CheckSecurity(String checkSecurityParam, HttpSessionState session) in d:\BuildAreas\RelFxnet3\FX3-81\Source\iFOREX Framework\IFOREX.Clients\iFOREX.Clients.Web\Common\Utils\SecurityHelper.cs:line 55
at iFOREX.Clients.Web.Common.Utils.SecurityHelper.CheckSecurity(HttpContext context) in d:\BuildAreas\RelFxnet3\FX3-81\Source\iFOREX Framework\IFOREX.Clients\iFOREX.Clients.Web\Common\Utils\SecurityHelper.cs:line 42
at iFOREX.Clients.Web.Handlers.ClientState.OnProcessRequest(HttpContext context) in d:\BuildAreas\RelFxnet3\FX3-81\Source\iFOREX Framework\IFOREX.Clients\iFOREX.Clients.Web\Handlers\ClientState\ClientState.ashx.cs:line 64
What I tried:
props.conf:
[WMI:Applications]
TRANSFORMS-wmi=wminull1
transforms.conf:
[wminull1]
REGEX = There is no security-data for the current context
DEST_KEY=queue
FORMAT=nullQueue
But I can't seem to make it work and have Splunk not index this event.
Can anyone please help?
Thanks
Hi,
The issue was solved by using the following regex:
REGEX = (?ms)There is no security-data for the current context
Thanks for the help.
Hi,
The issue was solved by using the following regex:
REGEX = (?ms)There is no security-data for the current context
Thanks for the help.
Ah, the text was split across multiple lines inside a multi-line event. That explains it.
My guess is that you have extra whitespace which you are not noticing; have you tested your RegEx against actual log messages? If you can't/won't, then try this and see if it works:
REGEX = There\s+is\s+no\s+security\s*-\s*data\s+for\s+the\s+current\s+context
Bad RegEx is the only thing that makes sense if you are certain that you have checked everything else already mentioned.
Does your original RegEx work in the search bar, too? Where exactly did you put your props.conf
and transforms.conf
files? Did you spell the filenames correctly?
Hi,
I haven't tried it with the original regex just with this one: There\s+is\s+no\s+security\s*-\s*data\s+for\s+the\s+current\s+context
So in the search line, if I enter: sourcetype="WMI:WinEventLog:Applications" | regex There\s+is\s+no\s+security\s*-\s*data\s+for\s+the\s+current\s+context
It seems to work and I do see the events
Now, want i want to filter them out and have Splunk not index them, i use:
Props.conf:
[WMI:WinEventLog:Applications]
TRANSFORMS-wmi = WinSecEvents-null
Transforms.conf:
[WinSecEvents-null]
REGEX = There\s+is\s+no\s+security\s*-\s*data\s+for\s+the\s+current\s+context
DEST_KEY=queue
FORMAT=nullQueue
And these doesn't seems to work. no matter what, Splunk keep indexing them and i See new entries.
thanks,
Hi,
if I use the regex There\s+is\s+no\s+security\s*-\s*data\s+for\s+the\s+current\s+context on the search line it works but if not on the transforms.conf
Thanks,
Hi,
if I use the regex There\s+is\s+no\s+security\s*-\s*data\s+for\s+the\s+current\s+context on the search line it works but if not on the transforms.conf
Thanks,
Make sure that...
WMI:Applications
exactlyHi Martin, Thanks for your reply.
I checked all you wrote and it's not the issue.
Am I using the right regex to filler out this event and have Splunk not index it?
Thanks