Splunk Enterprise

TRANSFORMS-null = setnull

gitingua
Communicator
  1. In props.conf, set the TRANSFORMS-null attribute:
    [ActiveDirectory]
    TRANSFORMS-null= setnull
  2. Create a corresponding stanza in transforms.conf. Set DEST_KEY to "queue" and FORMAT to "nullQueue":
    [setnull]
    REGEX = \[ms_Mcs_AdmPwdExpirationTime\]
    DEST_KEY = queue
    FORMAT = nullQueue
  3. Restart Splunk Enterprise.

    field = ms_Mcs_AdmPwdExpirationTime
    the values ​​are still in the index
    Not working.  what did I indicate wrong?
0 Karma

richgalloway
SplunkTrust
SplunkTrust

There likely is an error in the regex, but to know that for sure we'll need to see some example data.

---
If this reply helps you, Karma would be appreciated.
0 Karma

gitingua
Communicator

@richgalloway 

example

2Wc23q

C23gAwe3

0 Karma

richgalloway
SplunkTrust
SplunkTrust

There's the problem.  The example data does not match the regex since none of them contain the string "ms_Mcs_AdmPwdExpirationTime".  You'll have to find a regular expression that matches all expected strings you wish to send to the null queue.

---
If this reply helps you, Karma would be appreciated.
0 Karma

gitingua
Communicator

I was wrong. given string. "ms_Mcs_AdmPwd" there are random symbols of the unit and letters

@richgalloway 

0 Karma

gitingua
Communicator

@richgalloway 

props.conf

[ActiveDirectory]

TRANSFORMS-null = setnull

 

transforms.conf

[setnull]

REGEX = ms-Mcs-AdmPwd\s*=(.*)

DEST_KEY = queue

FORMAT = nullQueue

 

 

not working

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Again, to properly diagnose a regex problem we need to see the events that are to be matched.  Not just a tiny snippet, either.  Feel free to anonymize sensitive data.

Have you tested your regular expressions on a site like regex101.com?

---
If this reply helps you, Karma would be appreciated.
0 Karma

gitingua
Communicator

 

@richgalloway 

Снимок экрана 2021-11-12 в 17.21.43.png

 

yes. check in regex101. enable. 

tried different regex methods working. now standing which is in the picture above

0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...