Splunk Search

Using regex and time to discard results?

adrifs95
New Member

Good morning, 

 

I am trying to create a filter to avoid events where the user is 3 letters and 4 numbers (Not 0), f.e. FSA4568 and to avoid events at the time of entry to work for these users. I have created the filter for the user regex but I don't know how to integrate it with the time. The thing is that no events appear when the users have the structure of 3 letters plus four numbers and the time is between 7.30 and 9.30 a.m. How can I integrate it?

This is the search:

 

 

(index="anb_andorra" OR index="anb_luxembourg" OR index="anb_monaco" OR index="anb_espana") source="XmlWinEventLog:Security" ((EventCode IN (4771,4768) Error_Code=0x6)  OR (EventCode=4625 Error_Code="0xc000006d")) user!="*$" src!="::ffff:*"  
| regex user!="([A-Z]{3}[1-9]{4})"
| eval timestamp = _time*1000, name = signature

 

 

0 Karma

adrifs95
New Member

Good,

Ok I'm going to try but the problem is that I want both conditions USER AND TIME at the same time so as the user is in a regex I don't know how to use it.

0 Karma

yuanliu
SplunkTrust
SplunkTrust

Random code blobs are not sufficient to illustrate what you want to solve.  Always share sample data (anonymize as needed) and sample output from your code, then explain why the result is not what you expect.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @adrifs95,

did you explored the time_hour and time_minute fields?

(index="anb_andorra" OR index="anb_luxembourg" OR index="anb_monaco" OR index="anb_espana") source="XmlWinEventLog:Security" ((EventCode IN (4771,4768) Error_Code=0x6)  OR (EventCode=4625 Error_Code="0xc000006d")) user!="*$" src!="::ffff:*" ((time_hour>6 time_minute>29) (time_hour<10 time_minute<31)) 
| regex user!="([A-Z]{3}[1-9]{4})"
| eval timestamp = _time*1000, name = signature

If you don't have them, you can extract them using strftime funtion.

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...