Getting Data In

WinEventLog Security Regex


Hi Everyone,

I have windows security event filter setup and working on my indexer. However I want to filter on three variables.

The logic is as follows: Keep all events, except the ones that match the regex.

My current filter looks like this:

REGEX = (?msi)^EventCode=(123|678|910).*^(User=userxxx)
DEST_KEY = queue
FORMAT = nullQueue

I want to add one more variable to the filter (Type=Success Audit).

Also, in the future I may want to add a hostname to this regex, so that it only filters out these events on a certain host, so once host name is added it would be filtering on 4 variables.


Tags (1)
0 Karma


This works like a charm.


#Exclude Sample User Authentication Events



I do this to filter out all sorts of things. 🙂

0 Karma


What would be syntax for adding to the regex. I've only seen examples of addting two variables to a regex, not three or four.

0 Karma

Splunk Employee
Splunk Employee

Do you need to filter these independently or dependently? i.e. must we match the eventcode, type and user and host? or is it some combination, i.e eventcode+host or eventcode+user? for the former, just add to your regex, for the later, add multiple stanzas.

0 Karma
Get Updates on the Splunk Community!

User Groups | Upcoming Events!

If by chance you weren't already aware, the Splunk Community is host to numerous User Groups, organized ...

Splunk Lantern | Spotlight on Security: Adoption Motions, War Stories, and More

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Cloud | Empowering Splunk Administrators with Admin Config Service (ACS)

Greetings, Splunk Cloud Admins and Splunk enthusiasts! The Admin Configuration Service (ACS) team is excited ...