Getting Data In

How to search to exclude part of DIR from windows log?

codedtech
Path Finder

Hello All,  I'm trying to run query that will allow me to exclude events with part of a file path built in a windows event.  The event looks like this
alert: %PlaceStuffIsStored%\ANYTHING\STUFF\And\Things\Blah\Blah\Blah\Blah.EXE was allowed to run but would have been prevented from running if the AppLocker policy were enforced. I was able to Rex out the file path to now I have a new field called path which is Dir

Dir=%PlaceStuffIsStored%\ANYTHING\STUFF\And\Things\Blah\Blah\Blah\Blah.EXE

I've tried the basics but no luck 
Search!="*ANYTHING\STUFF\*" |mysearch  Not (Dir="*ANYTHING\STUFF\*")  
Thanks

0 Karma

cklunck
Path Finder

You may need to escape your backslashes. Does the following work?

<original_search>
| rex <extract Dir field here>
| search Dir!="*ANYTHING\\STUFF\\*"

 

Whether you use != or NOT as your exclusion operator is up to you - but understand that they may return different results. Check the article Difference between != and NOT for more details.

0 Karma
Get Updates on the Splunk Community!

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Index This | What goes away as soon as you talk about it?

May 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...