Props.conf / Regex question

flo_cognosec · ‎12-16-2011

I add this to props.conf to detect shellscripts, but interesting enough this not only matches shell-scripts but also a lot of other files as well, not matching the regex.

What am I missing ?

[rule::find_shellscript]
MORE_THAN_0 = ^#!\/bin\/(bash|sh)
LEARN_MODEL=false
LEARN_SOURCETYPE=false
sourcetype=shellscript

flo_cognosec · ‎12-21-2011

Seems like the MORE_THAN / LESS_THAN operators don't actually work as expected , was corrected in the docs already 😞

Props.conf / Regex question

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Splunk Add-on for Microsoft Windows 11.0.3: Parse Once, Search Faster

What's New in Splunk Enterprise Security 8.8 and Beyond

A Four-Part Event Series: State of Observability - Where AI Meets Performance

Join the Conversation

Props.conf / Regex question

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Splunk Add-on for Microsoft Windows 11.0.3: Parse Once, Search Faster

What's New in Splunk Enterprise Security 8.8 and Beyond

A Four-Part Event Series: State of Observability - Where AI Meets Performance