Another awesome Regex question, related to windows. I have a windows EventCode=4663. The event contains a Process_Name field which Splunk extracts successfully on its own.
I want to write a transform to send events that match this EventCode AND a three different possible Process_Names, to send them to the nullqueue. Yes, that's two criteria in a transform.
Is this possible? What's the correct syntax?
Using Perl Editors for Regex online, versus using the regex command or rex command in Splunkweb, versus trying a REGEX in transform - they all seem to be slightly different in the rules you have to follow....
Here's an example of an eventcode 4663:
Log Name: Security
Source: Microsoft-Windows-Security-Auditing
Date: 11/9/2011 5:12:18 AM
Event ID: 4663
Task Category: File System
Level: Information
Keywords: Audit Success
User: N/A
Computer: dcc1.Logistics.corp
Description:
An attempt was made to access an object.
Subject:
Security ID: SYSTEM
Account Name: dcc1$
Account Domain: LOGISTICS
Logon ID: 0x3e7
Object:
Object Server: Security
Object Type: File
Object Name:
C:\Windows\servicing\Packages\Package_2_for_KB2620704~31bf3856ad364e35~x86~~6.0.1.0.mum
Handle ID: 0x530
Process Information:
Process ID: 0xc0c
Process Name: C:\Windows\servicing\TrustedInstaller.exe
Access Request Information:
Accesses: WriteAttributes
Access Mask: 0x100
Hi,
Can't test this out myself at the mo, but have done something similar in the past.
Note, you have to escape the \'s and .'s in the process name, and proc 2 and proc 3 are the other processes you are trying to drop.
Give this a try
REGEX=(?msi)EventCode=4663.*Process\s+Name:\s+(C:\\Windows\\servicing\\TrustedInstaller\.exe|proc 2|proc 3)
DEST_KEY=queue
FORMAT=nullQueue
UPDATE splunk 6.*
Since this version you can actually specify a list or range of eventCodes to exclude at the forwarder level, in inputs.conf. It will reduce the volume at the forwarder level and reduce the network load.
see
http://docs.splunk.com/Documentation/Splunk/latest/Admin/Inputsconf
example:
[WinEventLog:Security]
disabled = 0
blacklist=566,800-850
Getting fairly good at this now, when I watch my syntax...magic ingredient is the following:
REGEX=(?msi)^EventCode=4663.+?Process\sName:\s+(C:\Windows\servicing\TrustedInstaller.exe|proc 2|proc 3)
DEST_KEY=queue
FORMAT=nullQueue
seems to work every time with this syntax....yay!!
Splunk stripped out my backslashes before the s's in the above phrase....should occur after "process" and "Name:"....
Hi,
Can't test this out myself at the mo, but have done something similar in the past.
Note, you have to escape the \'s and .'s in the process name, and proc 2 and proc 3 are the other processes you are trying to drop.
Give this a try
REGEX=(?msi)EventCode=4663.*Process\s+Name:\s+(C:\\Windows\\servicing\\TrustedInstaller\.exe|proc 2|proc 3)
DEST_KEY=queue
FORMAT=nullQueue