Using regex and time to discard results?

[adrifs95]

Good morning, 

I am trying to create a filter to avoid events where the user is 3 letters and 4 numbers (Not 0), f.e. FSA4568 and to avoid events at the time of entry to work for these users. I have created the filter for the user regex but I don't know how to integrate it with the time. The thing is that no events appear when the users have the structure of 3 letters plus four numbers and the time is between 7.30 and 9.30 a.m. How can I integrate it?

This is the search:

(index="anb_andorra" OR index="anb_luxembourg" OR index="anb_monaco" OR index="anb_espana") source="XmlWinEventLog:Security" ((EventCode IN (4771,4768) Error_Code=0x6)  OR (EventCode=4625 Error_Code="0xc000006d")) user!="*$" src!="::ffff:*"  
| regex user!="([A-Z]{3}[1-9]{4})"
| eval timestamp = _time*1000, name = signature

[adrifs95]

Good,

Ok I'm going to try but the problem is that I want both conditions USER AND TIME at the same time so as the user is in a regex I don't know how to use it.

[yuanliu]

Random code blobs are not sufficient to illustrate what you want to solve.  Always share sample data (anonymize as needed) and sample output from your code, then explain why the result is not what you expect.

[gcusello]

Hi @adrifs95,

did you explored the time_hour and time_minute fields?

(index="anb_andorra" OR index="anb_luxembourg" OR index="anb_monaco" OR index="anb_espana") source="XmlWinEventLog:Security" ((EventCode IN (4771,4768) Error_Code=0x6)  OR (EventCode=4625 Error_Code="0xc000006d")) user!="*$" src!="::ffff:*" ((time_hour>6 time_minute>29) (time_hour<10 time_minute<31)) 
| regex user!="([A-Z]{3}[1-9]{4})"
| eval timestamp = _time*1000, name = signature

If you don't have them, you can extract them using strftime funtion.

Ciao.

Giuseppe