How to create a report that lists the groups that a user belongs to?

[digital_alchemy]

Our Active Directory logs contain a field called member_of and the value contains all the groups that a user is a member of. I would like to be able to create a report in table form using something similar to the values command listing each group a user is a member of.

The data is within the field is in the following format:

CN=XH_VI_Office,OU=GRP,OU=CO,DC=xmm,DC=local|CN=G_Ma43_Users_BYOD_Cloud_Users,OU=GRP,OU=CO,DC=xmm,DC=local|CN=XA_Outlook,OU=GRP,OU=CO,DC=xmm,DC=local|CN=G_GO_Win_SQL,OU=GRP,OU=CO,DC=xmm,DC=local|CN=AAG_GO_Admin,OU=Iox,OU=GRP,DC=xmm,DC=local|CN=XD_WIN,OU=GRP,OU=CO,DC=xmm,DC=local

I just want a list of all the CN values to be returned in a field as mentioned before in a list similar to the values command. Is this something that would be possible? Below is my current search which will let me know if the user is in the local admin group or domain admin group, but I want to expand it as mentioned above to show all groups.

index=windows sourcetype=ActiveDirectory sAMAccountType=805306368  | dedup name | eval localAdmin=if(like(memberOf,"%Local-Admin%"),"yes","no"), domainAdmin=if(like(memberOf,"%Domain Admins%"),"yes","no") | rename name AS userID, mail AS email, telephoneNumber AS phone,postalCode AS zip, l AS city | table userID,localAdmin,domainAdmin,displayName,email,phone,city,st,zip,OU,department,company

[richgalloway · Accepted solution]

Try this.

index=windows sourcetype=ActiveDirectory sAMAccountType=805306368  | dedup name | rex field=test max_match=0 "CN=(?<memberOf>[^,]+)" | table userID, memberOf,displayName,email,phone,city,st,zip,OU,department,company

[digital_alchemy]

This works, thanks. Just had to change the field from test to the target field "memberOf