Props.conf / Regex question

flo_cognosec · ‎12-16-2011

I add this to props.conf to detect shellscripts, but interesting enough this not only matches shell-scripts but also a lot of other files as well, not matching the regex.

What am I missing ?

[rule::find_shellscript]
MORE_THAN_0 = ^#!\/bin\/(bash|sh)
LEARN_MODEL=false
LEARN_SOURCETYPE=false
sourcetype=shellscript

flo_cognosec · ‎12-21-2011

Seems like the MORE_THAN / LESS_THAN operators don't actually work as expected , was corrected in the docs already 😞

Props.conf / Regex question

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Announcing Modern Navigation: A New Era of Splunk User Experience

Modernize your Splunk Apps – Introducing Python 3.13 in Splunk

Step into “Hunt the Insider: An Splunk ES Premier Mystery” to catch a cybercriminal ...

Join the Conversation

Props.conf / Regex question

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Announcing Modern Navigation: A New Era of Splunk User Experience

Modernize your Splunk Apps – Introducing Python 3.13 in Splunk

Step into “Hunt the Insider: An Splunk ES Premier Mystery” to catch a cybercriminal ...