topic Re: Extract value from a field in Splunk Cloud Platform

Extract value from a field

verifi81 — Tue, 27 Apr 2021 00:07:25 GMT

Hello folks

I have a search in which I table. Here is a snippet of the results

ObjectDN _time

cn=Jane Fonda,OU=Blue,OU=Pad,OU=Circle Team,DC=circle,DC=net

2021-04-22 23:48:36

CN=Matt Cruz,OU=Blue,OU=Pad2,OU=Circle Team,DC=circle,DC=net

2021-04-22 01:07:43

If I want to extract the names contained in the CN to output to a column on it's own how would I do that?

Re: Extract value from a field

verifi81 — Tue, 27 Apr 2021 00:08:37 GMT

I don't know why the question cut off. My question is, if I wanted just the CN portion of the results to display in a separate column called "NAMES", how can I do that?

Re: Extract value from a field

ITWhisperer — Tue, 27 Apr 2021 06:16:41 GMT

| rex field=ObjectDN "CN=(?<NAMES>[^,]+)"

Re: Extract value from a field

verifi81 — Wed, 28 Apr 2021 23:39:20 GMT

ITWhisperer, thank you so much.

In some cases the CN is lower case so it doesn't match for those entries. Is there a way to make this case insensitive?

Re: Extract value from a field

ITWhisperer — Wed, 28 Apr 2021 23:43:20 GMT

| rex field=ObjectDN "(?i)CN=(?<NAMES>[^,]+)"

Re: Extract value from a field

verifi81 — Wed, 28 Apr 2021 23:44:27 GMT

Perfect. thank you so much.