Getting Data In

Rex command returns null despte the regular expression being correct

gynexcore
New Member

Hello there,

I am attempting to write a rex command that pulls the distinguished name from a windows event log. My regular expression claims to be working according to regex101.com, however, in Splunk the field DistName returns null every time when inside of a table. The specific info i am looking for is:

CN=John\, Doe,OU=K-O,OU=Reg,OU=Exit,OU=Heigh,DC=workbuilding,DC=treestump,DC=WalMart,DC=com

Here is my regular expression:

(?<DistName>(?=CN=|cn=).+?(?=.{6}:))

And here is a sample of a log that I am trying to parse:

A member was added to a security-enabled global group. Subject: Security ID:    X-9-9-99-999999999-9999999999-999999999-999999 Account Name:    Windows10 Account Domain: Logon ID: Member: Security ID:     Account Name:  CN=John\, Doe,OU=K-O,OU=Reg,OU=Exit,OU=Heigh,DC=workbuilding,DC=treestump,DC=WalMart,DC=com Group: Security ID: 9-9-99-999999999-9999999999-999999999-9999999 Group Name: Raush - Bestie User Certificate Access Group Domain: Additional Information: Privileges:      

Any help here would be greatly appreciated!

0 Karma
1 Solution

ololdach
Builder

Try this one:

(?<DistName>CN=|cn=.+)?\sGroup:

View solution in original post

0 Karma

ololdach
Builder

Try this one:

(?<DistName>CN=|cn=.+)?\sGroup:
0 Karma
Get Updates on the Splunk Community!

New Cloud Intrusion Detection System Add-on for Splunk

In July 2022 Splunk released the Cloud IDS add-on which expanded Splunk capabilities in security and data ...

Happy CX Day to our Community Superheroes!

Happy 10th Birthday CX Day!What is CX Day? It’s a global celebration recognizing innovation and success in the ...

Check out This Month’s Brand new Splunk Lantern Articles

Splunk Lantern is a customer success center providing advice from Splunk experts on valuable data insights, ...