Splunk Cloud Platform

Extract value from a field

verifi81
Path Finder

Hello folks

I have a search in which I table.  Here is a snippet of the results

 

ObjectDN _time

cn=Jane Fonda,OU=Blue,OU=Pad,OU=Circle Team,DC=circle,DC=net2021-04-22 23:48:36CN=Matt Cruz,OU=Blue,OU=Pad2,OU=Circle Team,DC=circle,DC=net2021-04-22 01:07:43

 

If I want to extract the names contained in the CN to output to a column on it's own how would I do that?

 

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| rex field=ObjectDN "(?i)CN=(?<NAMES>[^,]+)"

View solution in original post

0 Karma

verifi81
Path Finder

Perfect. thank you so much.

0 Karma

verifi81
Path Finder

I don't know why the question cut off.  My question is, if I wanted just the CN portion of the results to display in a separate column called "NAMES", how can I do that?

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| rex field=ObjectDN "CN=(?<NAMES>[^,]+)"
0 Karma

verifi81
Path Finder

ITWhisperer, thank you so much.

 

In some cases the CN is lower case so it doesn't match for those entries.  Is there a way to make this case insensitive?

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| rex field=ObjectDN "(?i)CN=(?<NAMES>[^,]+)"
0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...