Splunk Search

How to convert distinguishedName to canonical name using Regex?

kiran331
Builder

Hi

I have distinguishedName values from Ldap query, how can I convert it to canonical names using Regex?

for eg:

CN=test,OU=test service,OU=Special Accounts,DC=test,DC=com
CN=test1,OU=users,DC=test,DC=com

canonical name:

test.com/Special Accounts/test service/test
test.com/users/test1

0 Karma

DalJeanis
Legend

Here's one way...

| makeresults 
| eval mydata="CN=test,OU=test service,OU=Special Accounts,DC=test,DC=com!!!!CN=test1,OU=users,DC=test,DC=com" 
| makemv delim="!!!!" mydata 
| mvexpand mydata 
| rename mydata as _raw
| rename COMMENT as "The above just enters your test data."

| rename COMMENT as "Pull out the two DC members and put them together into the domain."
| rex "DC=(?<DC>[^,$]*)" max_match=0
| eval DC=mvindex(DC,0).".".mvindex(DC,1)

| rename COMMENT as "Pull out the other members, attach them each to a number so that we can sort them.."
| rename COMMENT as "This will fail if there are more than 10."
| rex "(OU|CN)=(?<OU>[^,$]*)" max_match=0
| eval sorter=mvzip(mvrange(0,mvcount(OU)),OU,"/")

| rename COMMENT as "Assign the record a number, fan the members out, sort them in reverse order"
| streamstats count as recno
| mvexpand sorter
| sort 0 recno - sorter

| rename COMMENT as "rename internal fields so they don't disappear, recombine the record, rename internal fields back"
| rename _time as Time, _raw as Raw
| mvcombine sorter
| rename Time as _time, Raw as _raw

| rename COMMENT as "Collapse the members into a single string again, then format the string."
| eval OU=mvjoin(sorter,"!!!!")
| rex mode=sed field=OU "s/(^\d|!!!!\d)//g"

| rename COMMENT as "Build the canonical by adding the folders back on the end of the domain."
| eval canonical=DC.OU
| table _time _raw canonical

Notes (1) _time and _raw would have disappeared in the mvcombine. If you plan to do anything with them, or any of the other internal fields, then you need to rename them before that point, then back again after that.

DalJeanis
Legend

This more complicated version would work for ten or more folders deep. Don't use this one unless you think you will actually need it, because it's pretty complicated and the guy who wrote it was probably just showing off or bored that he wasn't at .conf or something.

 | rename COMMENT as "Pull out the other members"
 | rex "(OU|CN)=(?<OU>[^,$]*)" max_match=0

 | rename COMMENT as "Create a range of 2-digit numbers, then attach each member to a number so that we can sort them.."
 | rename COMMENT as "This complex version will NOT fail if there are more than 10."
 | eval sorter =mvjoin(mvrange(0,mvcount(OU)),",")
 | rex mode=sed field=sorter "s/^(\d)/0\1/g s/(?<=,)(\d)(?=[,])/0\1/g s/(?<=,)(\d)$/0\1/g"
 | eval sorter=mvzip(split(sorter,","),OU,"/")
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...