How to convert distinguishedName to canonical name using Regex?

[kiran331]

Hi

I have distinguishedName values from Ldap query, how can I convert it to canonical names using Regex?

for eg:

CN=test,OU=test service,OU=Special Accounts,DC=test,DC=com
CN=test1,OU=users,DC=test,DC=com

canonical name:

test.com/Special Accounts/test service/test
test.com/users/test1

[DalJeanis]

Here's one way...

| makeresults 
| eval mydata="CN=test,OU=test service,OU=Special Accounts,DC=test,DC=com!!!!CN=test1,OU=users,DC=test,DC=com" 
| makemv delim="!!!!" mydata 
| mvexpand mydata 
| rename mydata as _raw
| rename COMMENT as "The above just enters your test data."

| rename COMMENT as "Pull out the two DC members and put them together into the domain."
| rex "DC=(?<DC>[^,$]*)" max_match=0
| eval DC=mvindex(DC,0).".".mvindex(DC,1)

| rename COMMENT as "Pull out the other members, attach them each to a number so that we can sort them.."
| rename COMMENT as "This will fail if there are more than 10."
| rex "(OU|CN)=(?<OU>[^,$]*)" max_match=0
| eval sorter=mvzip(mvrange(0,mvcount(OU)),OU,"/")

| rename COMMENT as "Assign the record a number, fan the members out, sort them in reverse order"
| streamstats count as recno
| mvexpand sorter
| sort 0 recno - sorter

| rename COMMENT as "rename internal fields so they don't disappear, recombine the record, rename internal fields back"
| rename _time as Time, _raw as Raw
| mvcombine sorter
| rename Time as _time, Raw as _raw

| rename COMMENT as "Collapse the members into a single string again, then format the string."
| eval OU=mvjoin(sorter,"!!!!")
| rex mode=sed field=OU "s/(^\d|!!!!\d)//g"

| rename COMMENT as "Build the canonical by adding the folders back on the end of the domain."
| eval canonical=DC.OU
| table _time _raw canonical

---

Notes (1) _time and _raw would have disappeared in the mvcombine. If you plan to do anything with them, or any of the other internal fields, then you need to rename them before that point, then back again after that.

[DalJeanis]

This more complicated version would work for ten or more folders deep. Don't use this one unless you think you will actually need it, because it's pretty complicated and the guy who wrote it was probably just showing off or bored that he wasn't at .conf or something.

 | rename COMMENT as "Pull out the other members"
 | rex "(OU|CN)=(?<OU>[^,$]*)" max_match=0

 | rename COMMENT as "Create a range of 2-digit numbers, then attach each member to a number so that we can sort them.."
 | rename COMMENT as "This complex version will NOT fail if there are more than 10."
 | eval sorter =mvjoin(mvrange(0,mvcount(OU)),",")
 | rex mode=sed field=sorter "s/^(\d)/0\1/g s/(?<=,)(\d)(?=[,])/0\1/g s/(?<=,)(\d)$/0\1/g"
 | eval sorter=mvzip(split(sorter,","),OU,"/")