Splunk Search

How to achieve field extraction to list domain admins from AD logs?

ggilmore1
Explorer

I have been trying to extract a field to list domain admins from AD logs. The logs have all the admins starting with a CN= as shown in the expression. Despite working on regex101, the expression won't extract on Splunk. I've tried making little modifications but to no avail. Please help.

Expression:

source="ActiveDirectory" AND "CN=Domain Admins" AND member=*

| rex field=_raw"(?<=CN=)[\w .]*(?=,)(?<admin>)/g"

 

The logs look similar to this:

CN=Admin Account,OU=Vendor Accounts,OU=IT,DC=domain,DC=domain

Labels (1)
0 Karma
1 Solution

PickleRick
SplunkTrust
SplunkTrust

With max_match=0 you should get the field extracted as multivalued field.

<your search>
| rex max_match=0 "CN=(?<cn>.*?),\w+="

With this regex or with the other one.

View solution in original post

PickleRick
SplunkTrust
SplunkTrust

Cut the "/g" part from  your regex unless your event contains such substring. I suppose it doesn't. That's one thing.

Another is that you have a capture group named "admin" but nothing to match in this group.

What do you want to match? Matching such strings can be tricky especially if you want to account for all the border cases.

0 Karma

ggilmore1
Explorer

Ideally, I would like to match all CN=Admin Account. My goal is to make a table with the admin accounts

0 Karma

PickleRick
SplunkTrust
SplunkTrust

Easiest approach to this would be something like

CN=(?<cn>[^,]+),

This way you're capturing everything between 'CN=' and a comma.

One caveat - if your CN contains literal comma (and I don't know if your logs should have it escaped in any way or not), only the part up to and not including the comma would be captured.

Assuming that there has to be another component of the DN, you can try to use this information like this:

CN=(?<cn>.*?),\w+=

In this case however you'd have problem if your CN included a ",SOMETHING=" string but it's sooooooo unlikely

0 Karma

ggilmore1
Explorer

I tried the first one and it works well. The problem is it seems to stop after the first one and I can't get it to repeat. Unfortunately I am pretty new to the world of regex

0 Karma

PickleRick
SplunkTrust
SplunkTrust

What do you mean by "stops after the first one"? Do your events contain multiple DNs per event? If so, add max_match=0 option to your rex command.

0 Karma

ggilmore1
Explorer

What I mean is the logs are like this:

CN=Admin Account,OU=Vendor Accounts,OU=IT,DC=domain,DC=domain|CN=Admin Account2,OU=Vendor Accounts,OU=IT,DC=domain,DC=domain

And the command stops after the first one.

0 Karma

PickleRick
SplunkTrust
SplunkTrust

With max_match=0 you should get the field extracted as multivalued field.

<your search>
| rex max_match=0 "CN=(?<cn>.*?),\w+="

With this regex or with the other one.

ggilmore1
Explorer

That's the one. Thank you sir for bearing with me

0 Karma
Get Updates on the Splunk Community!

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...