Splunk Enterprise Security

Need urgent help to filter out logs



Splunk which I am currently using has all of a sudden increased the log size consumption which has led to my license crossing the threshold. Only have two more warnings left. Have identified a way to filter out some of the Azure logs using regex on the logs. But for some reason the regex is not working. Can someone please help me why this regex is not working. While tested the regex it seems to be working fine but still logs are not getting filtered out even if it matches the criteria. 

I tested my regex in the online site regex101 and the content seems to match the regex. But still logs are not getting filtered out. Can someone please guide me what would be the reason. 

0 Karma
Get Updates on the Splunk Community!

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...

Security Highlights | January 2023 Newsletter

January 2023 Splunk Security Essentials (SSE) 3.7.0 ReleaseThe free Splunk Security Essentials (SSE) 3.7.0 app ...

Platform Highlights | January 2023 Newsletter

 January 2023Peace on Earth and Peace of Mind With Business ResilienceAll organizations can start the new year ...