Splunk Search

blacklist regex help

tkerr1357
Path Finder

Hello all,

I am trying to blacklist an event that is tied to a specific sAMAccountName which is sAMAccountName="Alertz - ProductFeedback" .  The only way I can think to achieve this is maybe with a blacklist regex statement but I am not sure and not very good with regex. Below is a sample event. Please let me know if there are any questions.

 

08/16/2023 09:34:07.541 dcName=RNBSAD1.rightnetworks.com admonEventType=Update Names: objectCategory=CN=Group,CN=Schema,CN=Configuration,DC=rightnetworks,DC=com name=Alertz - ProductFeedback distinguishedName=CN=Alertz - ProductFeedback,OU=Expired Alert Groups,OU=Desk Alerts,OU=Security Groups,DC=rightnetworks,DC=com cn=Alertz - ProductFeedback Object Details: sAMAccountType=268435456 sAMAccountName=Alertz - ProductFeedback objectSid=S-1-5-21-2605281412-2030159296-1019850961-856824 objectGUID=1e0bcfbf-dc8b-43e9-855a-7004ce3d6b3b whenChanged=09:33.53 AM, Wed 08/16/2023 whenCreated=09:31.41 AM, Tue 08/01/2023 objectClass=top|group Event Details: uSNChanged=820790490 uSNCreated=813674539 instanceType=4 Additional Details: dSCorePropagationData=16010101000000.0Z groupType=-2147483646

Labels (1)
0 Karma

yuanliu
SplunkTrust
SplunkTrust

The difficult seems to be that default extraction will use pairdelim=" ".  This ends up getting just "Alertz" in sAMAccountName.

There are any number of ways to overcome that depending on the exact problem you are trying to solve.  Assuming by "blacklist" you mean to simply pick events with this sAMAccountName value from all events, the most efficient way is to put the criterion in index search itself.

<all other search criteria> "sAMAccountName=Alertz - ProductFeedback"

Hope this helps.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

What have you tried so far?  Is the sAMAccuontName field already properly extracted (the complete value is present)?

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In September, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...

New in Observability - Improvements to Custom Metrics SLOs, Log Observer Connect & ...

The latest enhancements to the Splunk observability portfolio deliver improved SLO management accuracy, better ...

Improve Data Pipelines Using Splunk Data Management

  Register Now   This Tech Talk will explore the pipeline management offerings Edge Processor and Ingest ...