About vansicklj

vansicklj · ‎06-01-2021

I got your regex to match by swapping "?!" for "!?", adding a delimiter to ".exe", and removing a pair of parentheses: <Data Name='ProcessName'>(!?(C:\\Windows\\System32\\Taskmgr\.exe)).*$ See https://regex101.com/r/vGIN1P/1

vansicklj · ‎07-21-2020

BLUF: (on Windows Server 2019) install mscs Version 4.0.0. You can add/edit the Configuration and Inputs. v4.0.1 won't let you. If you install mscs 4.0.1, it hangs at "loading" and eventually crashes Splunk. Not sure what happens if you update v4.0.0 to v4.0.1 after configuring it - not willing to find out at this point 😞 Does not matter if installed before or after MS Azure Add-on/App for Splunk - still hangs at :loading".

Posts	2
Solutions	0
Karma Given	0
Karma Received	0
Member Since	‎07-21-2020

Online Status	Offline
Date Last Visited	‎05-31-2022 03:56 PM

Splunk Add-on for Microsoft Cloud Services (mscs) ...

Re: Inputs.conf blacklist with a negative regex

Splunk Add-on for Microsoft Cloud Services (mscs) ...