topic Re: regex to split names extracted from a string in Splunk Search

regex to split names extracted from a string

nathanluke86 — Thu, 19 Mar 2020 13:25:45 GMT

This is a little tricky to explain but I have this query:

index = active_directory directReports=* sAMAccountName=* 
| rex field=directReports max_match=0 "CN=(?<memberOf>[^,]+)"
| rex field=memberOf mode=sed "s/\./ /g"
| rename sAMAccountName as Manager memberOf as Employee
| table Manager Employee

This displays as manager in column 1 and lists employees in column 2 :

How can I unlist the employees as separate rows as follows

Manager employee
Manager employee
Manager employee
Manager employee

TIA

Re: regex to split names extracted from a string

manjunathmeti — Thu, 19 Mar 2020 13:47:25 GMT

You just need to expand Employee fields values:

index = active_directory directReports=* sAMAccountName=* 
| rex field=directReports max_match=0 "CN=(?<memberOf>[^,]+)"
| rex field=memberOf mode=sed "s/\./ /g"
| rename sAMAccountName as Manager memberOf as Employee
| mvexpand Employee
| table Manager Employee

Re: regex to split names extracted from a string

nathanluke86 — Thu, 19 Mar 2020 13:55:26 GMT

Thanks @manjunathmeti