Splunk Search

Regex to filter security events does'nt work, need help


Hi Guys,

We have UFs on our DCs and 2 indexers and on both indexers, to drop the unwanted text from events

I tried using the following regex in the /opt/splunk/etc/slave-apps/Splunk_TA_windows/local/props.conf

[WinEventLog:Security] SEDCMD-shortern4624 = SEDCMD-shortern4624 = s/(?mis)(.EventCode=4624.)This event is generated when a logon session.*$/\1/g

it does not work

0 Karma

Revered Legend

The SEDCMD is used for data masking (or in some cases editing) before indexing. For other log types you would, to drop the whole events which matches your regular expression, you would use Transforms (http://docs.splunk.com/Documentation/Splunk/6.5.2/Forwarding/Routeandfilterdatad#Discard_specific_ev...), but for Event Logs, you could just use blacklist attribute in inputs.conf on the Universal forwarder. See these


0 Karma


I do not want to drop the whole event i just want to drop the static text that gives the description about the event.

I am referring to this link https://www.splunk.com/blog/2012/09/21/the-splunk-app-for-active-directory-and-how-i-tamed-the-secur...

0 Karma

Revered Legend

Ok.. Try this (props.conf on your indexer, you may have to deploy it from cluster master instead of updating the slave-apps directly)

SEDCMD-shortern4624 = s/(?mis)(.*EventCode=4624.*)This event is generated when a logon session.*$/\1/g
0 Karma


yes i am already following the best practice of doing this in master apps and then deploying to slave-apps

Thanks, i used a different regex and this time its working

NOW following is wat i am using in my /opt/splunk/etc/slave-apps/splunk-TA-Windows/local

in props.conf
# message shortener for windows event security
# removes text from message field starting with: This event is generated
TRANSFORM-windows_events = win_event_shortener

in transforms.conf

DEST_KEY = _raw
REGEX = ((.*+[\v])+)(?=This event is generated)

0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes and swag!