Routing windows security logs to another index

[lclayton95]

I am trying to route my windows security logs to another specified index but it has to meet certain criteria.

EventCode has to be 4688 and the Token Elevation Level equals either %%1936, %%1938, TokenElevationTypeDefault, TokenElevationTypeLimited.

So far i have written these regular expressions

1. REGEX = ((?s).*EventCode=4688*.)((?si).*(%%1936|TokenElevationTypeDefault|TokenElevationTypeLimited)*.)

2. REGEX = EventCode=4688.*TokenElevationType=(%%1936|%%1938|TokenElevationTypeDefault|TokenElevationTypeLimited)

When using 1, All eventcodes 4688 come to the specified index when i only wanted 1936 and 1938. I wanted to leave the %%1937 token in its original index.

When using 2, no data at all comes to the index even though its seems to be a much simpler regex. What am i missing to ensure 4688 is properly filter using transforms and props?

[lclayton95]

Yeah i been testing on regex 101 seem to be some delta in how splunk processes the regex however. For example this is what i have so far

https://regex101.com/r/95JbuG/1 

but when i add another event to this the regex stops working

[marnall]

Could you try this regex:

(?s)EventCode=4688.*Token Elevation Type: (%%1936|%%1938|TokenElevationTypeDefault|TokenElevationTypeLimited)

And also post your (sanitized) props.conf and transforms.conf if it does not work?

[marnall]

In Regex 1, you seem to have .* backwards (*.) in two instances, where the one near the end is particularly problematic, so if you have:

(%%1936|TokenElevationTypeDefault|TokenElevationTypeLimited)*.

Then it will match strings like %%1936, 0 or more times, so it will match events which don't include %%1936 or the other strings. 

Try removing the *. near the end. Also I recommend testing the regex on a site like regex101.com to make sure your regex is working before you put it in your splunk config.