TRANSFORMS-null = setnull

[gitingua]

1. In props.conf, set the TRANSFORMS-null attribute:

   [ActiveDirectory]
   TRANSFORMS-null= setnull

2. Create a corresponding stanza in transforms.conf. Set DEST_KEY to "queue" and FORMAT to "nullQueue":

   [setnull]
   REGEX = \[ms_Mcs_AdmPwdExpirationTime\]
   DEST_KEY = queue
   FORMAT = nullQueue

3. Restart Splunk Enterprise.
   
   field = ms_Mcs_AdmPwdExpirationTime
   the values ​​are still in the index
   Not working.  what did I indicate wrong?

[richgalloway]

There likely is an error in the regex, but to know that for sure we'll need to see some example data.

[gitingua]

@richgalloway 

example

2Wc23q

C23gAwe3

[richgalloway]

There's the problem.  The example data does not match the regex since none of them contain the string "ms_Mcs_AdmPwdExpirationTime".  You'll have to find a regular expression that matches all expected strings you wish to send to the null queue.

[gitingua]

I was wrong. given string. "ms_Mcs_AdmPwd" there are random symbols of the unit and letters

@richgalloway 

[gitingua]

@richgalloway 

props.conf

[ActiveDirectory]

TRANSFORMS-null = setnull

transforms.conf

[setnull]

REGEX = ms-Mcs-AdmPwd\s*=(.*)

DEST_KEY = queue

FORMAT = nullQueue

not working

[richgalloway]

Again, to properly diagnose a regex problem we need to see the events that are to be matched.  Not just a tiny snippet, either.  Feel free to anonymize sensitive data.

Have you tested your regular expressions on a site like regex101.com?

[gitingua]

@richgalloway 

yes. check in regex101. enable. 

tried different regex methods working. now standing which is in the picture above