Help with rex

zindain24 — Mon, 28 Sep 2020 12:06:49 GMT

We are looking to create a multi field rex command to capture the following:
1. Firstname Lastname
2. OrgUnit

I am having trouble getting the "Firstname Lastname" to parse properly, here is what I have so far:
|rex field=_raw "(?) CN=(?[^,]+)"

Help is greatly appreciated!

Here is a raw event:
07/18/2012 09:00:29 AM LogName=Security SourceName=Microsoft Windows security auditing. EventCode=4728 EventType=0 Type=Information ComputerName=SERVERNAME.domain.com TaskCategory=Security Group Management OpCode=Info RecordNumber=1688571344 Keywords=Audit Success Message=A member was added to a security-enabled global group. Subject: Security ID: DOMAIN\test003 Account Name: test003 Account Domain: DOMAIN Logon ID: 0x6356e0a1e Member: Security ID: DOMAIN\LOGONID Account Name: CN=Firstname Lastname,OU=OrgUnit,OU=Non-Domain Users,OU=People,DC=company,DC=com Group: Security ID: DOMAIN\SD-INSTALL-ASSET_MANAGEMENT Group Name: GP-GROUP-GROUPNAME_MANAGEMENT Group Domain: DOMAIN Additional Information: Privileges: -

Re: Help with rex

lguinn2 — Wed, 18 Jul 2012 16:00:08 GMT

Splunk should already be extracting the OrgUnit as it is in field=value format. It will call the field OU, but you can set a field alias if you want a different name. The name is more of a problem, as it contains whitespace.

To extract them both:

 ... | rex field=_raw "CN=(?<cname>.+?),OU=(?<orgunit>\S+)"

To extract just the cname:

 ... | rex field=_raw "CN=(?<cname>.+?),"

topic Re: Help with rex in Splunk Search

Help with rex

Re: Help with rex