Hi friends!   How to discard Windows events of type EventCode = 4663 from Splunk executables? Dismiss only Splunk-related events: SplunkUniversalForwarder \ bin \ splunk-powershell.exe splunk-regmon.exe splunk-admon.exe To reduce the consumption of the Splunk license. Example log: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{}'/><EventID>4663</EventID><Version>1</Version><Level>0</Level><Task>12802</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2021-02-23T14:56:54.615235600Z'/><EventRecordID>835675728</EventRecordID><Correlation/><Execution ProcessID='4' ThreadID='10472'/><Channel>Security</Channel><Computer>DC01.net</Computer><Security/></System><EventData><Data Name='SubjectUserSid'>NT AUTHORITY\SYSTEM</Data><Data Name='SubjectUserName'>DC01$</Data><Data Name='SubjectDomainName'>DC01</Data><Data Name='SubjectLogonId'>0x3e7</Data><Data Name='ObjectServer'>Security</Data><Data Name='ObjectType'>SymbolicLink</Data><Data Name='ObjectName'>\SHARE??\E:</Data><Data Name='HandleId'>0x94</Data><Data Name='AccessList'>%%4544</Data><Data Name='AccessMask'>0x1</Data><Data Name='ProcessId'>0x1fa8</Data><Data Name='ProcessName'>E:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe</Data><Data Name='ResourceAttributes'>-</Data></EventData></Event>   Thanks in advancend!   James \o/ ... View more

Hi All. How to break this log block so that it reads each row as an event, and this log is not in timestamp format? The date would be the start and end of the user session on the system. The following is an example of the log: cod|user |system |day|month|year|hour|minute|day|month|year|hour|minute 001|00129810|cis2121000 |01|03|18|10|46|01|03|18|10|46 001|user001 |cis2200000 |01|03|18|10|46|01|03|18|10|46 001|00129810|cis2121000 |01|03|18|10|46|01|03|18|10|46 001|user001 |cisli2100m000 |01|03|18|10|46|01|03|18|10|46 001|user001 |cisli2100m000 |01|03|18|10|46|01|03|18|10|46 001|00129810|cis2121000 |01|03|18|10|46|01|03|18|10|46 001|00129810|cisli2100m000 |01|03|18|10|46|01|03|18|10|46 001|00821888|cis0121000 |01|03|18|10|46|01|03|18|10|46 001|user001 |cis2200000 |01|03|18|10|46|01|03|18|10|46 Do I have to configure in props.conf and transform.conf by sourcetype? REGEX = = (.{3}).(.{8}).(.{16}).(.{2}).(.{2}).(.{2}).(.{2}).(.{2}).(.{2}).(.{2}).(.{2}).(.{2}).(.{2}) FORMAT = emp::$1 user::$2 session_id::$3 datei_mday::$4 datei_month::$5 datei_year::$6 datei_hour::$7 datei_minute::$8 datef_mday::$9 datef_month::$10 datef_year::$11 datef_hour::$12 datef_minute::$13 I tried to create this REGEX, but it did not work. Can you help me please? Best Regards. ... View more