parse elements of a DN

[dominiquevocat]

In some logs i have ldap DNs which i want to slice a part out from it like the CN or the PATH without the DN. The DNs i have get potentially in different formats.

Format 1:
O=xxx\OU=yyy\OU=zzz\CN=xyz

Format 2:
\xxx\yyy\zzz

Format 3:
CN=xyz,OU=zzz,OU=yyy,O=xxx

I would like to parse the elements and get all elements minus the first one etc.

I presume a custom command or macro could help there but i really really hope someone has done something similar.

[alacercogitatus · Accepted solution]

Most often, Splunk will auto-extract some parts of the DN. Format3 is most likely auto-extracted because of key value pairs. Format 2 is probably a near impossibility, since the data presented is probably of variable length, so extraction without separators won't happen. Format 1 could probably be done with a regex:

your_Search | rex field=_raw "CN=(?<cn>[\w\d\s]+)" | rex field=_raw "OU=(?<org_unit>[^=]*)="|eval ou = substr(org_unit,-2)| rex field=_raw "O=(?<o_unit>[^=])="|eval o = substr(o_unit,-2)| stats count values(ou) by cn, o

The evals are necessary because the matching will capture "OU" from the next string, prior to the =. All of these rex's could be put into props/tranforms to make the searches cleaner.