Ingest actions/nullQueue not working for some Windows multiline events.

[gazoscreek]

I'm trying to remove some Windows events from being ingested ... example below:

The regex I've tried in both Ingest Actions and the old method works both at regex101 and in my SPL

index=win* EventCode=4103 Message=*Files\\SplunkUniversalForwarder* 
| regex "EventCode=4103(.|\r|\n)+\s+Files.SplunkUniversalForwarder.bin.splunk-powershell.ps1"


Yet, when I configure an ingest action ruleset, nothing gets removed. 
[_rule:ruleset_WinEventLogSecurity:filter:regex:ft7j3fkn]
INGEST_EVAL = queue=if(match(_raw, "EventCode=4103(.|\\r|\\n)+\\s+Files.SplunkUniversalForwarder.bin.splunk-powershell.ps1"), "nullQueue", queue)
STOP_PROCESSING_IF = queue == "nullQueue"

same goes for trying to do it "the old way"

[drop_4103_splunkpowershell]
DEST_KEY = queue
REGEX = EventCode=4103(.|\r|\n)+\s+Files.SplunkUniversalForwarder.bin.splunk-powershell.ps1
FORMAT = nullQueue

04/04/2024 07:02:28 PM

LogName=Microsoft-Windows-PowerShell/Operational
EventCode=4103
EventType=4
ComputerName=redacted
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-PowerShell
Type=Information
RecordNumber=1258288151
Keywords=None
TaskCategory=Executing Pipeline
OpCode=To be used when operation is just executing a method
Message=CommandInvocation(Start-Sleep): "Start-Sleep"
ParameterBinding(Start-Sleep): name="Milliseconds"; value="200"

Context:

        Severity = Informational
        Host Name = ConsoleHost
        Host Version = 5.1.17763.5576
        Host ID = 222d8490-3c1f-486d-94ed-47f91e59da32
        Host Application = powershell.exe -command $input |C:\Program` Files\SplunkUniversalForwarder\bin\splunk-powershell.ps1 C:\Program` Files\SplunkUniversalForwarder e20c0be00a8583fe
        Engine Version = 5.1.17763.5576
        Runspace ID = 87084a50-365f-409b-aed6-d666c6c6b2b
        Pipeline ID = 1
        Command Name = Start-Sleep
        Command Type = Cmdlet
        Script Name = ....... 

[gazoscreek]

Thank you kindly ... this worked perfectly.

[richgalloway · Accepted solution]

IME, \r and \n don't always work in Splunk regexes.  To match any text that might include newlines, try [\s\S]+.

EventCode=4103[\s\S]+\s+Files\\SplunkUniversalForwarder\\bin\\splunk-powershell\.ps1