Splunk Search

How do I only show certain values in a field?

Dallastek
Explorer

I'm trying to group ldap log values. I have already listed them out from a comma separated value but, I'm having a hard time getting them the way I want them to display. I'm trying to create a new field and show just the CN
here is my query - sourcetype=mysearch user_ldap_user_attributes_memberOf=business_group1 | stats values(user_ldap_user_attributes_memberOf) as Group | makemv delim="," Group
here is my results-
CN=ExchangeUsers

OU=Groups
OU=business
DC=us
DC=ad
DC=corp
DC=com
CN=FAMS_Users
OU=Groups
OU=business
DC=us
DC=ad
DC=corp
DC=com
CN=EXCHANGE_ACTIVESYNC
OU=Dynagroups
OU=Enterprise Groups
DC=us
DC=ad
DC=corp
DC=com
CN=Tableau
OU=Groups
OU=business
DC=us
DC=ad
DC=corp
DC=com
CN=Web_Access
OU=Groups
OU=business
DC=us
DC=ad
DC=corp
DC=com

0 Karma
1 Solution

sundareshr
Legend

See of one of these give you what you're looking for

sourcetype=mysearch user_ldap_user_attributes_memberOf=business_group1 | stats values(user_ldap_user_attributes_memberOf) as Group | makemv delim="," Group | mvexpand Group | search Group="CN*"

*OR*

    sourcetype=mysearch user_ldap_user_attributes_memberOf=business_group1 | stats values(user_ldap_user_attributes_memberOf) as Group | makemv delim="," Group | eval Group=mvfilter(Group, "CN=")

View solution in original post

0 Karma

sundareshr
Legend

See of one of these give you what you're looking for

sourcetype=mysearch user_ldap_user_attributes_memberOf=business_group1 | stats values(user_ldap_user_attributes_memberOf) as Group | makemv delim="," Group | mvexpand Group | search Group="CN*"

*OR*

    sourcetype=mysearch user_ldap_user_attributes_memberOf=business_group1 | stats values(user_ldap_user_attributes_memberOf) as Group | makemv delim="," Group | eval Group=mvfilter(Group, "CN=")
0 Karma

Dallastek
Explorer

The first query worked like a charm. The second gave me an error "The arguments to the 'mvfilter' function are invalid."
Thanks! I was WAY over thinking it

0 Karma
Get Updates on the Splunk Community!

Developer Spotlight with William Searle

The Splunk Guy: A Developer’s Path from Web to Cloud William is a Splunk Professional Services Consultant with ...

Major Splunk Upgrade – Prepare your Environment for Splunk 10 Now!

Attention App Developers: Test Your Apps with the Splunk 10.0 Beta and Ensure Compatibility Before the ...

Stay Connected: Your Guide to June Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...