Getting Data In

How to search to exclude part of DIR from windows log?

codedtech
Path Finder

Hello All,  I'm trying to run query that will allow me to exclude events with part of a file path built in a windows event.  The event looks like this
alert: %PlaceStuffIsStored%\ANYTHING\STUFF\And\Things\Blah\Blah\Blah\Blah.EXE was allowed to run but would have been prevented from running if the AppLocker policy were enforced. I was able to Rex out the file path to now I have a new field called path which is Dir

Dir=%PlaceStuffIsStored%\ANYTHING\STUFF\And\Things\Blah\Blah\Blah\Blah.EXE

I've tried the basics but no luck 
Search!="*ANYTHING\STUFF\*" |mysearch  Not (Dir="*ANYTHING\STUFF\*")  
Thanks

Labels (1)
0 Karma

cklunck
Path Finder

You may need to escape your backslashes. Does the following work?

<original_search>
| rex <extract Dir field here>
| search Dir!="*ANYTHING\\STUFF\\*"

 

Whether you use != or NOT as your exclusion operator is up to you - but understand that they may return different results. Check the article Difference between != and NOT for more details.

0 Karma
Get Updates on the Splunk Community!

New in Observability - Improvements to Custom Metrics SLOs, Log Observer Connect & ...

The latest enhancements to the Splunk observability portfolio deliver improved SLO management accuracy, better ...

Improve Data Pipelines Using Splunk Data Management

  Register Now   This Tech Talk will explore the pipeline management offerings Edge Processor and Ingest ...

3-2-1 Go! How Fast Can You Debug Microservices with Observability Cloud?

Register Join this Tech Talk to learn how unique features like Service Centric Views, Tag Spotlight, and ...