How to achieve field extraction to list domain admins from AD logs?

[ggilmore1]

I have been trying to extract a field to list domain admins from AD logs. The logs have all the admins starting with a CN= as shown in the expression. Despite working on regex101, the expression won't extract on Splunk. I've tried making little modifications but to no avail. Please help.

Expression:

source="ActiveDirectory" AND "CN=Domain Admins" AND member=*

| rex field=_raw"(?<=CN=)[\w .]*(?=,)(?<admin>)/g"

The logs look similar to this:

CN=Admin Account,OU=Vendor Accounts,OU=IT,DC=domain,DC=domain

[PickleRick]

Cut the "/g" part from  your regex unless your event contains such substring. I suppose it doesn't. That's one thing.

Another is that you have a capture group named "admin" but nothing to match in this group.

What do you want to match? Matching such strings can be tricky especially if you want to account for all the border cases.

[ggilmore1]

Ideally, I would like to match all CN=Admin Account. My goal is to make a table with the admin accounts

[PickleRick]

Easiest approach to this would be something like

CN=(?<cn>[^,]+),

This way you're capturing everything between 'CN=' and a comma.

One caveat - if your CN contains literal comma (and I don't know if your logs should have it escaped in any way or not), only the part up to and not including the comma would be captured.

Assuming that there has to be another component of the DN, you can try to use this information like this:

CN=(?<cn>.*?),\w+=

In this case however you'd have problem if your CN included a ",SOMETHING=" string but it's sooooooo unlikely

[ggilmore1]

I tried the first one and it works well. The problem is it seems to stop after the first one and I can't get it to repeat. Unfortunately I am pretty new to the world of regex

[PickleRick]

What do you mean by "stops after the first one"? Do your events contain multiple DNs per event? If so, add max_match=0 option to your rex command.

[ggilmore1]

What I mean is the logs are like this:

CN=Admin Account,OU=Vendor Accounts,OU=IT,DC=domain,DC=domain|CN=Admin Account2,OU=Vendor Accounts,OU=IT,DC=domain,DC=domain

And the command stops after the first one.

[PickleRick · Accepted solution]

With max_match=0 you should get the field extracted as multivalued field.

<your search>
| rex max_match=0 "CN=(?<cn>.*?),\w+="

With this regex or with the other one.

[ggilmore1]

That's the one. Thank you sir for bearing with me