Splunk Search

Regex on a WMI security and Splunk formating

jordans
Path Finder

Hi,

I want to filter out all Successful NULL user logins from the Windows Security logs by using transforms.conf to send to the nullQueue before indexing.

In the Search app, the lines are displayed as:

  ...
  Type=Audit Success
  User=NULL    
  ...

But I am not sure how to create the regex to handle both lines even though the lines come after one another. All the regex testers I have tried have not been helpful.

Tags (1)
0 Karma
1 Solution

jordans
Path Finder

I ended up figuring it out eventually, with some added features:

(?m)Type=Audit\sSuccess(\s+.*\s+){6}Account\sName:\s+(USERNAME1|USERNAME2)

View solution in original post

0 Karma

jordans
Path Finder

I ended up figuring it out eventually, with some added features:

(?m)Type=Audit\sSuccess(\s+.*\s+){6}Account\sName:\s+(USERNAME1|USERNAME2)
0 Karma

Simeon
Splunk Employee
Splunk Employee

By default, Splunk should extract those fields with it's automatic field extraction. For any key=value, Splunk is pretty friendly. To optimize a search that finds all of these:

  • Make sure "Type" and "User" get extracted. you may need to turn on field discovery and pick them from the field picker

Assuming each event contains both of these lines, here is the search:

Audit Success NULL | search User=NULL Type="Audit Success"

OR

User=NULL Type="Audit Success"

To filter these events from your results, you want to negate the terms:

NOT User=NULL NOT Type="Audit Success"
0 Karma

jordans
Path Finder

But that's my whole point. I need to know what the regex is ...

0 Karma

Simeon
Splunk Employee
Splunk Employee

Sounds like you want to do conditional routing to the nullqueue for specific events. The following thread explains how to route to nullqueue (won't get indexed). You want to modify the regex to recognize your specific events:

http://splunk-base.splunk.com/answers/11102/can-i-devnull-a-sourcetype

0 Karma

jordans
Path Finder

I'm afraid I was not clear. I want to filter them out before indexing, so I need to configure transforms.conf. That's the regex I need to figure out.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...