https://community.splunk.com/t5/Security/parse-elements-of-a-DN/m-p/62392#M2075 <P>Most often, Splunk will auto-extract some parts of the DN. Format3 is most likely auto-extracted because of key value pairs. Format 2 is probably a near impossibility, since the data presented is probably of variable length, so extraction without separators won't happen. Format 1 could probably be done with a regex: </P> <P><CODE>your_Search | rex field=_raw "CN=(?&lt;cn&gt;[\w\d\s]+)" | rex field=_raw "OU=(?&lt;org_unit&gt;[^=]*)="|eval ou = substr(org_unit,-2)| rex field=_raw "O=(?&lt;o_unit&gt;[^=])="|eval o = substr(o_unit,-2)| stats count values(ou) by cn, o</CODE></P> <P>The evals are necessary because the matching will capture "OU" from the next string, prior to the =. All of these rex's could be put into props/tranforms to make the searches cleaner. </P> Thu, 13 Dec 2012 13:49:25 GMT alacercogitatus 2012-12-13T13:49:25Z https://community.splunk.com/t5/Security/parse-elements-of-a-DN/m-p/62391#M2074 <P>In some logs i have ldap DNs which i want to slice a part out from it like the CN or the PATH without the DN. The DNs i have get potentially in different formats.</P> <P>Format 1:<BR /> O=xxx\OU=yyy\OU=zzz\CN=xyz</P> <P>Format 2:<BR /> \xxx\yyy\zzz</P> <P>Format 3:<BR /> CN=xyz,OU=zzz,OU=yyy,O=xxx</P> <P>I would like to parse the elements and get all elements minus the first one etc.</P> <P>I presume a custom command or macro could help there but i really really hope someone has done something similar.</P> Thu, 13 Dec 2012 13:24:11 GMT https://community.splunk.com/t5/Security/parse-elements-of-a-DN/m-p/62391#M2074 dominiquevocat 2012-12-13T13:24:11Z https://community.splunk.com/t5/Security/parse-elements-of-a-DN/m-p/62392#M2075 <P>Most often, Splunk will auto-extract some parts of the DN. Format3 is most likely auto-extracted because of key value pairs. Format 2 is probably a near impossibility, since the data presented is probably of variable length, so extraction without separators won't happen. Format 1 could probably be done with a regex: </P> <P><CODE>your_Search | rex field=_raw "CN=(?&lt;cn&gt;[\w\d\s]+)" | rex field=_raw "OU=(?&lt;org_unit&gt;[^=]*)="|eval ou = substr(org_unit,-2)| rex field=_raw "O=(?&lt;o_unit&gt;[^=])="|eval o = substr(o_unit,-2)| stats count values(ou) by cn, o</CODE></P> <P>The evals are necessary because the matching will capture "OU" from the next string, prior to the =. All of these rex's could be put into props/tranforms to make the searches cleaner. </P> Thu, 13 Dec 2012 13:49:25 GMT https://community.splunk.com/t5/Security/parse-elements-of-a-DN/m-p/62392#M2075 alacercogitatus 2012-12-13T13:49:25Z