I’m in a pickle (splunk license) again this morning and I’m trying to address it via a transform.
bit bucket for windows security events
[setnull1]
REGEX=(?m)EventCode=(515|517|537|538|540|551|552|560|565|566|576|577|578|592|593|600|601|626|627|628|629|633|641|642|645|646|647|659|660|661|664|665|666|671|672|673|674|675|680|682|683|684|832|833|835|836|837|861|4688|4902|4674|4675|4663$
REGEX=(user= someuserid|anotheruserid|anotheruserid)
DEST_KEY = queue
FORMAT = nullQueue
The stuff I've commented out below doesn’t work:
REGEX=(user=someuserid|anotheruserid|anotheruserid)
DEST_KEY = queue
FORMAT = nullQueue
How can I accomplish this? Basically my issue is I have a working transform for:
[WinEventLog:Security]
TRANSFORMS-set = setnull1
[WinEventLog:security]
TRANSFORMS-set = setnull1
I need to regex out another field in the same transform. Is this possible?
You can have more than one transform stanza referenced under a single TRANSFORM heading in props.conf, you just add commas between them.
Something like this should work.
Transforms.conf
[setnull1]
REGEX=(?m)EventCode=(515|517|537|538|540|551|552|560|565|566|576|577|578|592|593|600|601|626|627|628|629|633|641|642|645|646)
DEST_KEY = queue
FORMAT = nullQueue
[setnull2]
REGEX = (?mi)user\s*?=\s*?(userid1|userid2|userid3)
DEST_KEY = queue
FORMAT = nullQueue
props.conf
[WinEventLog:Security]
TRANSFORMS-setnullqueue = setnull1, setnull2
You can have more than one transform stanza referenced under a single TRANSFORM heading in props.conf, you just add commas between them.
Something like this should work.
Transforms.conf
[setnull1]
REGEX=(?m)EventCode=(515|517|537|538|540|551|552|560|565|566|576|577|578|592|593|600|601|626|627|628|629|633|641|642|645|646)
DEST_KEY = queue
FORMAT = nullQueue
[setnull2]
REGEX = (?mi)user\s*?=\s*?(userid1|userid2|userid3)
DEST_KEY = queue
FORMAT = nullQueue
props.conf
[WinEventLog:Security]
TRANSFORMS-setnullqueue = setnull1, setnull2
Thanks for the help eddit0r worked mint after I figured out that the space between:
TRANSFORMS-setnullqueue = setnull1, setnull2
should not be there. Found another thread titled "Filtering Windows event logs" then changed my props and volia! v8 moment...
Working now!
Well thanks for the suggestion, but neither are working. It seems that it only process's one transform. My last attempt my props was this:
[WinEventLog:Security]
TRANSFORMS-set = setnull1
TRANSFORMS-set = setnull5
[WinEventLog:security]
TRANSFORMS-set = setnull1
TRANSFORMS-set = setnull5
And my transforms is this:
[setnull1]
REGEX=(?m)EventCode=(515|517|537|538|540|551|552|560|565|566|576|577|578|592|593|600|601|626|627|628|629|633|641|642|645|646$
DEST_KEY = queue
FORMAT = nullQueue
[setnull5]
REGEX=user=someusername
DEST_KEY = queue
FORMAT = nullQueue
I attempted to add "user=" on the end of the close "paran )" but Splunk just ignored it.
I'm stymied
I'm not very familiar with the format of Windows security logs, but I see some possible approaches:
user
regex to the EventCode
regex, such as (?m)EventCode=(123|456|...|899).*user=(someuser|otheruser)
TRANSFORM
s, setnull-eventcodes
and setnull-users
, so you get a config like this:
[setnull-eventcodes]
REGEX = ...
DEST_KEY = queue
FORMAT = nullQueue
[setnull-users]
REGEX = ...
DEST_KEY = queue
FORMAT = nullQueue
[WinEventLog:Security]
TRANSFORMS-setnull0 = setnull-eventcodes
TRANSFORMS-setnull1 = setnull-eventcodes