Splunk Search
Highlighted

How to filter out multiple fields in the same transform with regex?

Path Finder

I’m in a pickle (splunk license) again this morning and I’m trying to address it via a transform.

bit bucket for windows security events

[setnull1]
REGEX=(?m)EventCode=(515|517|537|538|540|551|552|560|565|566|576|577|578|592|593|600|601|626|627|628|629|633|641|642|645|646|647|659|660|661|664|665|666|671|672|673|674|675|680|682|683|684|832|833|835|836|837|861|4688|4902|4674|4675|4663$
REGEX=(user= someuserid|anotheruserid|anotheruserid)
DEST_KEY = queue
FORMAT = nullQueue

The stuff I've commented out below doesn’t work:

REGEX=(user=someuserid|anotheruserid|anotheruserid)
DEST_KEY = queue
FORMAT = nullQueue

How can I accomplish this? Basically my issue is I have a working transform for:

[WinEventLog:Security]
TRANSFORMS-set = setnull1

[WinEventLog:security]
TRANSFORMS-set = setnull1

I need to regex out another field in the same transform. Is this possible?

0 Karma
Highlighted

Re: How to filter out multiple fields in the same transform with regex?

Communicator

I'm not very familiar with the format of Windows security logs, but I see some possible approaches:

  • Add the user regex to the EventCoderegex, such as (?m)EventCode=(123|456|...|899).*user=(someuser|otheruser)
  • Have two TRANSFORMs, setnull-eventcodes and setnull-users, so you get a config like this: [setnull-eventcodes] REGEX = ... DESTKEY = queue FORMAT = nullQueue [setnull-users] REGEX = ... DESTKEY = queue FORMAT = nullQueue [WinEventLog:Security] TRANSFORMS-setnull0 = setnull-eventcodes TRANSFORMS-setnull1 = setnull-eventcodes
0 Karma
Highlighted

Re: How to filter out multiple fields in the same transform with regex?

Path Finder

Well thanks for the suggestion, but neither are working. It seems that it only process's one transform. My last attempt my props was this:
[WinEventLog:Security]
TRANSFORMS-set = setnull1
TRANSFORMS-set = setnull5

[WinEventLog:security]
TRANSFORMS-set = setnull1
TRANSFORMS-set = setnull5

And my transforms is this:

bit bucket for windows security events

[setnull1]
REGEX=(?m)EventCode=(515|517|537|538|540|551|552|560|565|566|576|577|578|592|593|600|601|626|627|628|629|633|641|642|645|646$
DEST_KEY = queue
FORMAT = nullQueue

[setnull5]
REGEX=user=someusername
DEST_KEY = queue
FORMAT = nullQueue

I attempted to add "user=" on the end of the close "paran )" but Splunk just ignored it.

I'm stymied

0 Karma
Highlighted

Re: How to filter out multiple fields in the same transform with regex?

Explorer

You can have more than one transform stanza referenced under a single TRANSFORM heading in props.conf, you just add commas between them.

Something like this should work.

Transforms.conf
[setnull1]
REGEX=(?m)EventCode=(515|517|537|538|540|551|552|560|565|566|576|577|578|592|593|600|601|626|627|628|629|633|641|642|645|646)
DEST_KEY = queue
FORMAT = nullQueue

[setnull2]
REGEX = (?mi)user\s*?=\s*?(userid1|userid2|userid3)
DEST_KEY = queue
FORMAT = nullQueue

props.conf
[WinEventLog:Security]
TRANSFORMS-setnullqueue = setnull1, setnull2

View solution in original post

Highlighted

Re: How to filter out multiple fields in the same transform with regex?

Path Finder

Thanks for the help eddit0r worked mint after I figured out that the space between:
TRANSFORMS-setnullqueue = setnull1, setnull2
should not be there. Found another thread titled "Filtering Windows event logs" then changed my props and volia! v8 moment...

Working now!

Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.