https://community.splunk.com/t5/Splunk-Search/How-to-create-a-report-that-lists-the-groups-that-a-user-belongs/m-p/316675#M94754 <P>Try this.</P> <PRE><CODE>index=windows sourcetype=ActiveDirectory sAMAccountType=805306368 | dedup name | rex field=test max_match=0 "CN=(?&lt;memberOf&gt;[^,]+)" | table userID, memberOf,displayName,email,phone,city,st,zip,OU,department,company </CODE></PRE> Thu, 23 Feb 2017 18:43:05 GMT richgalloway 2017-02-23T18:43:05Z https://community.splunk.com/t5/Splunk-Search/How-to-create-a-report-that-lists-the-groups-that-a-user-belongs/m-p/316674#M94753 <P>Our Active Directory logs contain a field called <STRONG>member_of</STRONG> and the value contains all the groups that a user is a member of. I would like to be able to create a report in table form using something similar to the values command listing each group a user is a member of.</P> <P>The data is within the field is in the following format:</P> <PRE><CODE>CN=XH_VI_Office,OU=GRP,OU=CO,DC=xmm,DC=local|CN=G_Ma43_Users_BYOD_Cloud_Users,OU=GRP,OU=CO,DC=xmm,DC=local|CN=XA_Outlook,OU=GRP,OU=CO,DC=xmm,DC=local|CN=G_GO_Win_SQL,OU=GRP,OU=CO,DC=xmm,DC=local|CN=AAG_GO_Admin,OU=Iox,OU=GRP,DC=xmm,DC=local|CN=XD_WIN,OU=GRP,OU=CO,DC=xmm,DC=local </CODE></PRE> <P>I just want a list of all the CN values to be returned in a field as mentioned before in a list similar to the values command. Is this something that would be possible? Below is my current search which will let me know if the user is in the local admin group or domain admin group, but I want to expand it as mentioned above to show all groups.</P> <PRE><CODE>index=windows sourcetype=ActiveDirectory sAMAccountType=805306368 | dedup name | eval localAdmin=if(like(memberOf,"%Local-Admin%"),"yes","no"), domainAdmin=if(like(memberOf,"%Domain Admins%"),"yes","no") | rename name AS userID, mail AS email, telephoneNumber AS phone,postalCode AS zip, l AS city | table userID,localAdmin,domainAdmin,displayName,email,phone,city,st,zip,OU,department,company </CODE></PRE> Thu, 23 Feb 2017 18:34:38 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-a-report-that-lists-the-groups-that-a-user-belongs/m-p/316674#M94753 digital_alchemy 2017-02-23T18:34:38Z https://community.splunk.com/t5/Splunk-Search/How-to-create-a-report-that-lists-the-groups-that-a-user-belongs/m-p/316675#M94754 <P>Try this.</P> <PRE><CODE>index=windows sourcetype=ActiveDirectory sAMAccountType=805306368 | dedup name | rex field=test max_match=0 "CN=(?&lt;memberOf&gt;[^,]+)" | table userID, memberOf,displayName,email,phone,city,st,zip,OU,department,company </CODE></PRE> Thu, 23 Feb 2017 18:43:05 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-a-report-that-lists-the-groups-that-a-user-belongs/m-p/316675#M94754 richgalloway 2017-02-23T18:43:05Z https://community.splunk.com/t5/Splunk-Search/How-to-create-a-report-that-lists-the-groups-that-a-user-belongs/m-p/316676#M94755 <P>This works, thanks. Just had to change the field from test to the target field "memberOf</P> Thu, 23 Feb 2017 20:01:03 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-a-report-that-lists-the-groups-that-a-user-belongs/m-p/316676#M94755 digital_alchemy 2017-02-23T20:01:03Z