Two Events with the same sourcetype to NullQueue

[Michael_Schyma1]

Is there a way to combine two stanzas in transforms in order to block events.

in this case specific event codes and account names that end in $:

what we have is this in Props:

[WinEventLog:Security]
TRANSFORMS-null=setnull
EXTRACT-e1="SECID Account Name: (?P<SECID_account_name>\S+)"
EXTRACT-e2="(?<!SECID )Account Name: (?P<account_name>\S+)"


[WinEventLog:Security]
TRANSFORMS-null=setnullwindows
#Block all items that end with $

AND Transforms:

[setnullwindows]
REGEX= Account.Name:\W+.+\$
DEST_KEY = queue
FORMAT = nullQueue
#Block Security ID's that end with $ sign



[setnull]
REGEX= EventCode=(534|4776|4688|4672|4662|4634|4648|4907|4768|4696|5061|576|697|673|538|560|552)
DEST_KEY = queue
FORMAT = nullQueue
#4688 A new process has been created. #block 11/14
#4624 An account was successfully logged on.

[jbsplunk · Accepted solution]

Transforms that send data to nullQueue work on a regex, so all you have to do is add a regex that will match both patterns. You're already doing that with 'setnull', as you're matching multiple event types. Just add another OR operator and match the pattern defined in 'setnullwindows'

REGEX = EventCode=(534|4776|4688|4672|4662|4634|4648|4907|4768|4696|5061|576|697|673|538|560|552)|(Account.Name:\W+.+\$)

I don't have a copy of your events, so I would suggest that you test to ensure the pattern works with a site like http://gskinner.com/RegExr/

Once you're done with that, you can just change props to refer to one transform instead of the two you have presently.

For instance, afterward it might look something like this:

props.conf

[WinEventLog:Security]
TRANSFORMS-null=setnull
EXTRACT-e1="SECID Account Name: (?P<SECID_account_name>\S+)"
EXTRACT-e2="(?<!SECID )Account Name: (?P<account_name>\S+)"

[WinEventLog:Security]
TRANSFORMS-null=setnull


transforms.conf:

[setnull]
REGEX= EventCode=(534|4776|4688|4672|4662|4634|4648|4907|4768|4696|5061|576|697|673|538|560|552)|(Account.Name:\W+.+\$)
DEST_KEY = queue
FORMAT = nullQueue