Regex to filter security events does'nt work, need help

[hrithiktej]

Hi Guys,

We have UFs on our DCs and 2 indexers and on both indexers, to drop the unwanted text from events

I tried using the following regex in the /opt/splunk/etc/slave-apps/Splunk_TA_windows/local/props.conf

[WinEventLog:Security] SEDCMD-shortern4624 = SEDCMD-shortern4624 = s/(?mis)(.EventCode=4624.)This event is generated when a logon session.*$/\1/g

it does not work

[somesoni2]

The SEDCMD is used for data masking (or in some cases editing) before indexing. For other log types you would, to drop the whole events which matches your regular expression, you would use Transforms (http://docs.splunk.com/Documentation/Splunk/6.5.2/Forwarding/Routeandfilterdatad#Discard_specific_ev...), but for Event Logs, you could just use blacklist attribute in inputs.conf on the Universal forwarder. See these

https://answers.splunk.com/answers/152131/filter-windows-eventcode-using-blacklist-and-whitelist.htm...
http://docs.splunk.com/Documentation/Splunk/7.0.0/Data/MonitorWindowseventlogdata#Create_advanced_fi...

[hrithiktej]

I do not want to drop the whole event i just want to drop the static text that gives the description about the event.

I am referring to this link https://www.splunk.com/blog/2012/09/21/the-splunk-app-for-active-directory-and-how-i-tamed-the-secur...

[somesoni2]

Ok.. Try this (props.conf on your indexer, you may have to deploy it from cluster master instead of updating the slave-apps directly)

[WinEventLog:Security] 
SEDCMD-shortern4624 = s/(?mis)(.*EventCode=4624.*)This event is generated when a logon session.*$/\1/g

[hrithiktej]

yes i am already following the best practice of doing this in master apps and then deploying to slave-apps

Thanks, i used a different regex and this time its working

NOW following is wat i am using in my /opt/splunk/etc/slave-apps/splunk-TA-Windows/local

in props.conf
# message shortener for windows event security
# removes text from message field starting with: This event is generated
[WinEventLog:Security]
TRANSFORM-windows_events = win_event_shortener

in transforms.conf

[win_event_shortener]
DEST_KEY = _raw
REGEX = ((.*+[\v])+)(?=This event is generated)
FORMAT = $1