Getting Data In

Ingest actions/nullQueue not working for some Windows multiline events.

gazoscreek
Path Finder

I'm trying to remove some Windows events from being ingested ... example below:

The regex I've tried in both Ingest Actions and the old method works both at regex101 and in my SPL

index=win* EventCode=4103 Message=*Files\\SplunkUniversalForwarder* 
| regex "EventCode=4103(.|\r|\n)+\s+Files.SplunkUniversalForwarder.bin.splunk-powershell.ps1"


Yet, when I configure an ingest action ruleset, nothing gets removed.
[_rule:ruleset_WinEventLogSecurity:filter:regex:ft7j3fkn]
INGEST_EVAL = queue=if(match(_raw, "EventCode=4103(.|\\r|\\n)+\\s+Files.SplunkUniversalForwarder.bin.splunk-powershell.ps1"), "nullQueue", queue)
STOP_PROCESSING_IF = queue == "nullQueue"

same goes for trying to do it "the old way"

[drop_4103_splunkpowershell]
DEST_KEY = queue
REGEX = EventCode=4103(.|\r|\n)+\s+Files.SplunkUniversalForwarder.bin.splunk-powershell.ps1
FORMAT = nullQueue

 

04/04/2024 07:02:28 PM

LogName=Microsoft-Windows-PowerShell/Operational
EventCode=4103
EventType=4
ComputerName=redacted
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-PowerShell
Type=Information
RecordNumber=1258288151
Keywords=None
TaskCategory=Executing Pipeline
OpCode=To be used when operation is just executing a method
Message=CommandInvocation(Start-Sleep): "Start-Sleep"
ParameterBinding(Start-Sleep): name="Milliseconds"; value="200"

Context:

        Severity = Informational
        Host Name = ConsoleHost
        Host Version = 5.1.17763.5576
        Host ID = 222d8490-3c1f-486d-94ed-47f91e59da32
        Host Application = powershell.exe -command $input |C:\Program` Files\SplunkUniversalForwarder\bin\splunk-powershell.ps1 C:\Program` Files\SplunkUniversalForwarder e20c0be00a8583fe
        Engine Version = 5.1.17763.5576
        Runspace ID = 87084a50-365f-409b-aed6-d666c6c6b2b
        Pipeline ID = 1
        Command Name = Start-Sleep
        Command Type = Cmdlet
        Script Name = ....... 

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

IME, \r and \n don't always work in Splunk regexes.  To match any text that might include newlines, try [\s\S]+.

EventCode=4103[\s\S]+\s+Files\\SplunkUniversalForwarder\\bin\\splunk-powershell\.ps1
---
If this reply helps you, Karma would be appreciated.

View solution in original post

gazoscreek
Path Finder

Thank you kindly ... this worked perfectly.

richgalloway
SplunkTrust
SplunkTrust

IME, \r and \n don't always work in Splunk regexes.  To match any text that might include newlines, try [\s\S]+.

EventCode=4103[\s\S]+\s+Files\\SplunkUniversalForwarder\\bin\\splunk-powershell\.ps1
---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...