Hi Guys,
We have UFs on our DCs and 2 indexers and on both indexers, to drop the unwanted text from events
I tried using the following regex in the /opt/splunk/etc/slave-apps/Splunk_TA_windows/local/props.conf
[WinEventLog:Security] SEDCMD-shortern4624 = SEDCMD-shortern4624 = s/(?mis)(.EventCode=4624.)This event is generated when a logon session.*$/\1/g
it does not work
The SEDCMD is used for data masking (or in some cases editing) before indexing. For other log types you would, to drop the whole events which matches your regular expression, you would use Transforms (http://docs.splunk.com/Documentation/Splunk/6.5.2/Forwarding/Routeandfilterdatad#Discard_specific_ev...), but for Event Logs, you could just use blacklist attribute in inputs.conf on the Universal forwarder. See these
https://answers.splunk.com/answers/152131/filter-windows-eventcode-using-blacklist-and-whitelist.htm...
http://docs.splunk.com/Documentation/Splunk/7.0.0/Data/MonitorWindowseventlogdata#Create_advanced_fi...
I do not want to drop the whole event i just want to drop the static text that gives the description about the event.
I am referring to this link https://www.splunk.com/blog/2012/09/21/the-splunk-app-for-active-directory-and-how-i-tamed-the-secur...
Ok.. Try this (props.conf on your indexer, you may have to deploy it from cluster master instead of updating the slave-apps directly)
[WinEventLog:Security]
SEDCMD-shortern4624 = s/(?mis)(.*EventCode=4624.*)This event is generated when a logon session.*$/\1/g
yes i am already following the best practice of doing this in master apps and then deploying to slave-apps
Thanks, i used a different regex and this time its working
NOW following is wat i am using in my /opt/splunk/etc/slave-apps/splunk-TA-Windows/local
in props.conf
# message shortener for windows event security
# removes text from message field starting with: This event is generated
[WinEventLog:Security]
TRANSFORM-windows_events = win_event_shortener
in transforms.conf
[win_event_shortener]
DEST_KEY = _raw
REGEX = ((.*+[\v])+)(?=This event is generated)
FORMAT = $1