Splunk Search

data filter

blebit
Path Finder

hello ,

@ props.conf

[host::TheHost]

TRANSFORMS-ReadData_bktfileserver = filter_ReadData

[WinEventLog:Security]
TRANSFORMS-filter4663 = filter_4663_readdata

@ transforms.conf

Filter EventCode=4663 (Filter ReadData)

[filter_4663_readdata]
REGEX = EventCode=4663.*?ReadData (or ListDirectory)
DEST_KEY = queue
FORMAT = nullQueue

Can anybody help me ??? i am trying to filter eventcode 4663 but only those who have dhe extension "ReadData (or ListDirectory)"

0 Karma

hRun
Path Finder

I'm not quite sure I understood your question.

What do you mean by "filter"? Extracting the field or discarding it?

At the moment, you are creating the field "filter4663" in props.conf and tie it to your regex in transforms.conf, which gets discarded by FORMAT=nullQueue. So eventcode 4663 is replaced with nothing.

The regex doesn't seem to be valid, it should look like this:

REGEX = (?i)EventCode=4663.*ReadData\s\(or\sListDirectory\)

0 Karma

blebit
Path Finder

thanks for the answer,
the point is that i want to drop all eventcodes 4663 for Object access with message "ReadData", because i have too much logs. BUT 4663 is for DELETE either. thats why i want to filter based on message attached to eventcode.

0 Karma

lukejadamec
Super Champion

Try this:

REGEX= "(?msi)EventCode=4663.*readdata|EventCode=4663.*listdirectory"

lukejadamec
Super Champion

Good news. Feel free to accept the answer.

0 Karma

blebit
Path Finder

thanks. it works

0 Karma

lukejadamec
Super Champion

That was the one I used for testing. I fixed it.
I tested this in the search window, and it worked fine.

0 Karma

blebit
Path Finder

why 4625? i want 4663

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...