Getting Data In

Transform at Index

New Member

I am attempting to build a exporting field that ArcSight can use to properly categorize. Here what I got:

transform.conf
[devClassName]
REGEX = ($m)EventCode=(\d+)
FORMAT = devClassID::Microsoft-Windows-security-auditing:$1
WRITE_META = true

props.conf
[WinEventLog:Security]
TRANSFORMS-DevExtract = devClassName

fields.conf
[devClassID]
INDEXED = true

I need the result to be: Microsoft-Windows-security-auditing:4663 were as 4663 is pulled from EventCode in Splunk.

I have tried to build the transform just on my search forwarder, but it does not allow me to use the var $1

0 Karma

Splunk Employee
Splunk Employee

Hi baumerr,

Seems the regex in your [devClassName] stanza is incorrect. Should be:

REGEX = (?m)^EventCode=(\d+)

The (?m)^ in the REGEX indicates a multi-line event that starts with EventCode. Please try again using the suggested regex statement.

Hope it will work. Thanks!
Hunter