Getting Data In

WMI filtering only eventlog from some users

pmelchiori
Explorer

I'm looking for a way to filter all the log eventlog from certain user's group (SYSTEM and Administrator), but all my test going bad 😞

(splunk 4.1.6)

prof.conf:

[wmi]
TRANSFORMS-wminull = wmi-null, wmi-parsing

transforms.conf

[wmi-null]
REGEX = .
DEST_KEY = queue
FORMAT = nullQueue  

[wmi-parsing]
REGEX = (?m)^User=(SYSTEM|Administrator)
DEST_KEY = queue
FORMAT = nullQueue
0 Karma

sdwilkerson
Contributor

pmelchiori,

It looks like you have the syntax mostly right, but you need to check a few things.

Is the sourcetype that you want to drop just "wmi" or is it "wmi:WinEventLog:Security" etc? Make sure this is explicit.

Additionally, your transform will apply to a SOURCE_KEY = _raw unless otherwise stated. Your _raw will probably be equal to the entire event. That would mean that the string "user=XXX" is NOT at the beginning of the event, and therefore you don't want the carat "^" in your regex.

Finally, you have two transforms, that do two different things. The top one has a REGEX = (.).
In Regex, a dot "." means match any single character. So, this will match anything and mark it all to the nullQueue. I am not sure your intention here, but you may want to adjust this or maybe even omit the first transform in lieu of the second.

Check the sourcetype, check your transforms, fix that in props.conf and then remove your carat and see how that goes.

Best,

Sean

sdwilkerson
Contributor

See my updated answer above.

0 Karma

pmelchiori
Explorer

Okay, I've made all the changes but it still archiving any log!

Switching the props.conf in wmi:WinEventLog:Security it stops working totally.

0 Karma

MarioM
Motivator

did you try the followings:

REGEX = (.)

AND/OR

REGEX = (?msi)^User=(SYSTEM|Administrator)
0 Karma

pmelchiori
Explorer

Yes, it does't filter anything, I can see all the logs in Splunk.

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...