Splunk Search

REGEX in transforms for windows path and EventCode

gsawyer1
Engager

Another awesome Regex question, related to windows. I have a windows EventCode=4663. The event contains a Process_Name field which Splunk extracts successfully on its own.
I want to write a transform to send events that match this EventCode AND a three different possible Process_Names, to send them to the nullqueue. Yes, that's two criteria in a transform.

Is this possible? What's the correct syntax?

Using Perl Editors for Regex online, versus using the regex command or rex command in Splunkweb, versus trying a REGEX in transform - they all seem to be slightly different in the rules you have to follow....
Here's an example of an eventcode 4663:

Log Name: Security

Source: Microsoft-Windows-Security-Auditing

Date: 11/9/2011 5:12:18 AM

Event ID: 4663

Task Category: File System

Level: Information

Keywords: Audit Success

User: N/A

Computer: dcc1.Logistics.corp

Description:
An attempt was made to access an object.

Subject:

Security ID: SYSTEM

Account Name: dcc1$

Account Domain: LOGISTICS

Logon ID: 0x3e7

Object:

Object Server: Security

Object Type: File

Object Name:

C:\Windows\servicing\Packages\Package_2_for_KB2620704~31bf3856ad364e35~x86~~6.0.1.0.mum

Handle ID: 0x530

Process Information:

Process ID: 0xc0c

Process Name:   C:\Windows\servicing\TrustedInstaller.exe

Access Request Information:

Accesses: WriteAttributes

Access Mask: 0x100

0 Karma
1 Solution

JovanMilosevic
Path Finder

Hi,

Can't test this out myself at the mo, but have done something similar in the past.

Note, you have to escape the \'s and .'s in the process name, and proc 2 and proc 3 are the other processes you are trying to drop.

Give this a try

REGEX=(?msi)EventCode=4663.*Process\s+Name:\s+(C:\\Windows\\servicing\\TrustedInstaller\.exe|proc 2|proc 3)

DEST_KEY=queue

FORMAT=nullQueue

View solution in original post

0 Karma

yannK
Splunk Employee
Splunk Employee

UPDATE splunk 6.*
Since this version you can actually specify a list or range of eventCodes to exclude at the forwarder level, in inputs.conf. It will reduce the volume at the forwarder level and reduce the network load.

see
http://docs.splunk.com/Documentation/Splunk/latest/Admin/Inputsconf

example:

[WinEventLog:Security]
disabled = 0
blacklist=566,800-850

gsawyer1
Engager

Getting fairly good at this now, when I watch my syntax...magic ingredient is the following:

REGEX=(?msi)^EventCode=4663.+?Process\sName:\s+(C:\Windows\servicing\TrustedInstaller.exe|proc 2|proc 3)
DEST_KEY=queue
FORMAT=nullQueue

seems to work every time with this syntax....yay!!

0 Karma

gsawyer1
Engager

Splunk stripped out my backslashes before the s's in the above phrase....should occur after "process" and "Name:"....

0 Karma

JovanMilosevic
Path Finder

Hi,

Can't test this out myself at the mo, but have done something similar in the past.

Note, you have to escape the \'s and .'s in the process name, and proc 2 and proc 3 are the other processes you are trying to drop.

Give this a try

REGEX=(?msi)EventCode=4663.*Process\s+Name:\s+(C:\\Windows\\servicing\\TrustedInstaller\.exe|proc 2|proc 3)

DEST_KEY=queue

FORMAT=nullQueue

View solution in original post

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!