REGEX in transforms for windows path and EventCode

[gsawyer1]

Another awesome Regex question, related to windows. I have a windows EventCode=4663. The event contains a Process_Name field which Splunk extracts successfully on its own.
I want to write a transform to send events that match this EventCode AND a three different possible Process_Names, to send them to the nullqueue. Yes, that's two criteria in a transform.

Is this possible? What's the correct syntax?

Using Perl Editors for Regex online, versus using the regex command or rex command in Splunkweb, versus trying a REGEX in transform - they all seem to be slightly different in the rules you have to follow....
Here's an example of an eventcode 4663:

Log Name: Security

Source: Microsoft-Windows-Security-Auditing

Date: 11/9/2011 5:12:18 AM

Event ID: 4663

Task Category: File System

Level: Information

Keywords: Audit Success

User: N/A

Computer: dcc1.Logistics.corp

Description:
An attempt was made to access an object.

Subject:

Security ID: SYSTEM

Account Name: dcc1$

Account Domain: LOGISTICS

Logon ID: 0x3e7

Object:

Object Server: Security

Object Type: File

Object Name:

C:\Windows\servicing\Packages\Package_2_for_KB2620704~31bf3856ad364e35~x86~~6.0.1.0.mum

Handle ID: 0x530

Process Information:

Process ID: 0xc0c

Process Name:   C:\Windows\servicing\TrustedInstaller.exe

Access Request Information:

Accesses: WriteAttributes

Access Mask: 0x100

[yannK]

UPDATE splunk 6.*
Since this version you can actually specify a list or range of eventCodes to exclude at the forwarder level, in inputs.conf. It will reduce the volume at the forwarder level and reduce the network load.

see
http://docs.splunk.com/Documentation/Splunk/latest/Admin/Inputsconf

example:

[WinEventLog:Security]
disabled = 0
blacklist=566,800-850

[gsawyer1]

Getting fairly good at this now, when I watch my syntax...magic ingredient is the following:

REGEX=(?msi)^EventCode=4663.+?Process\sName:\s+(C:\Windows\servicing\TrustedInstaller.exe|proc 2|proc 3)
DEST_KEY=queue
FORMAT=nullQueue

seems to work every time with this syntax....yay!!

[gsawyer1]

Splunk stripped out my backslashes before the s's in the above phrase....should occur after "process" and "Name:"....

[JovanMilosevic · Accepted solution]

Hi,

Can't test this out myself at the mo, but have done something similar in the past.

Note, you have to escape the \'s and .'s in the process name, and proc 2 and proc 3 are the other processes you are trying to drop.

Give this a try

REGEX=(?msi)EventCode=4663.*Process\s+Name:\s+(C:\\Windows\\servicing\\TrustedInstaller\.exe|proc 2|proc 3)

DEST_KEY=queue

FORMAT=nullQueue