Splunk Search

How to create a report that lists the groups that a user belongs to?

digital_alchemy
Path Finder

Our Active Directory logs contain a field called member_of and the value contains all the groups that a user is a member of. I would like to be able to create a report in table form using something similar to the values command listing each group a user is a member of.

The data is within the field is in the following format:

CN=XH_VI_Office,OU=GRP,OU=CO,DC=xmm,DC=local|CN=G_Ma43_Users_BYOD_Cloud_Users,OU=GRP,OU=CO,DC=xmm,DC=local|CN=XA_Outlook,OU=GRP,OU=CO,DC=xmm,DC=local|CN=G_GO_Win_SQL,OU=GRP,OU=CO,DC=xmm,DC=local|CN=AAG_GO_Admin,OU=Iox,OU=GRP,DC=xmm,DC=local|CN=XD_WIN,OU=GRP,OU=CO,DC=xmm,DC=local

I just want a list of all the CN values to be returned in a field as mentioned before in a list similar to the values command. Is this something that would be possible? Below is my current search which will let me know if the user is in the local admin group or domain admin group, but I want to expand it as mentioned above to show all groups.

index=windows sourcetype=ActiveDirectory sAMAccountType=805306368  | dedup name | eval localAdmin=if(like(memberOf,"%Local-Admin%"),"yes","no"), domainAdmin=if(like(memberOf,"%Domain Admins%"),"yes","no") | rename name AS userID, mail AS email, telephoneNumber AS phone,postalCode AS zip, l AS city | table userID,localAdmin,domainAdmin,displayName,email,phone,city,st,zip,OU,department,company
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Try this.

index=windows sourcetype=ActiveDirectory sAMAccountType=805306368  | dedup name | rex field=test max_match=0 "CN=(?<memberOf>[^,]+)" | table userID, memberOf,displayName,email,phone,city,st,zip,OU,department,company
---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Try this.

index=windows sourcetype=ActiveDirectory sAMAccountType=805306368  | dedup name | rex field=test max_match=0 "CN=(?<memberOf>[^,]+)" | table userID, memberOf,displayName,email,phone,city,st,zip,OU,department,company
---
If this reply helps you, Karma would be appreciated.

digital_alchemy
Path Finder

This works, thanks. Just had to change the field from test to the target field "memberOf

0 Karma
Get Updates on the Splunk Community!

Index This | Divide 100 by half. What do you get?

November 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Stay Connected: Your Guide to December Tech Talks, Office Hours, and Webinars!

❄️ Celebrate the season with our December lineup of Community Office Hours, Tech Talks, and Webinars! ...

Splunk and Fraud

Watch Now!Watch an insightful webinar where we delve into the innovative approaches to solving fraud using the ...