How to filter out multiple fields in the same transform with regex?

[cdupuis123]

I’m in a pickle (splunk license) again this morning and I’m trying to address it via a transform.

bit bucket for windows security events

[setnull1]
REGEX=(?m)EventCode=(515|517|537|538|540|551|552|560|565|566|576|577|578|592|593|600|601|626|627|628|629|633|641|642|645|646|647|659|660|661|664|665|666|671|672|673|674|675|680|682|683|684|832|833|835|836|837|861|4688|4902|4674|4675|4663$
REGEX=(user= someuserid|anotheruserid|anotheruserid)
DEST_KEY = queue
FORMAT = nullQueue

The stuff I've commented out below doesn’t work:

REGEX=(user=someuserid|anotheruserid|anotheruserid)
DEST_KEY = queue
FORMAT = nullQueue

How can I accomplish this? Basically my issue is I have a working transform for:

[WinEventLog:Security]
TRANSFORMS-set = setnull1

[WinEventLog:security]
TRANSFORMS-set = setnull1

I need to regex out another field in the same transform. Is this possible?

[eddit0r · Accepted solution]

You can have more than one transform stanza referenced under a single TRANSFORM heading in props.conf, you just add commas between them.

Something like this should work.

Transforms.conf
[setnull1]
REGEX=(?m)EventCode=(515|517|537|538|540|551|552|560|565|566|576|577|578|592|593|600|601|626|627|628|629|633|641|642|645|646)
DEST_KEY = queue
FORMAT = nullQueue

[setnull2]
REGEX = (?mi)user\s*?=\s*?(userid1|userid2|userid3)
DEST_KEY = queue
FORMAT = nullQueue

props.conf
[WinEventLog:Security]
TRANSFORMS-setnullqueue = setnull1, setnull2

[cdupuis123]

Thanks for the help eddit0r worked mint after I figured out that the space between:
TRANSFORMS-setnullqueue = setnull1, setnull2
should not be there. Found another thread titled "Filtering Windows event logs" then changed my props and volia! v8 moment...

Working now!

[cdupuis123]

Well thanks for the suggestion, but neither are working. It seems that it only process's one transform. My last attempt my props was this:
[WinEventLog:Security]
TRANSFORMS-set = setnull1
TRANSFORMS-set = setnull5

[WinEventLog:security]
TRANSFORMS-set = setnull1
TRANSFORMS-set = setnull5

And my transforms is this:

bit bucket for windows security events

[setnull1]
REGEX=(?m)EventCode=(515|517|537|538|540|551|552|560|565|566|576|577|578|592|593|600|601|626|627|628|629|633|641|642|645|646$
DEST_KEY = queue
FORMAT = nullQueue

[setnull5]
REGEX=user=someusername
DEST_KEY = queue
FORMAT = nullQueue

I attempted to add "user=" on the end of the close "paran )" but Splunk just ignored it.

I'm stymied

[laserval]

I'm not very familiar with the format of Windows security logs, but I see some possible approaches:

• Add the user regex to the EventCoderegex, such as (?m)EventCode=(123|456|...|899).*user=(someuser|otheruser)
• Have two TRANSFORMs, setnull-eventcodes and setnull-users, so you get a config like this: [setnull-eventcodes] REGEX = ... DEST_KEY = queue FORMAT = nullQueue [setnull-users] REGEX = ... DEST_KEY = queue FORMAT = nullQueue [WinEventLog:Security] TRANSFORMS-setnull0 = setnull-eventcodes TRANSFORMS-setnull1 = setnull-eventcodes