Splunk Search

How to create a report that lists the groups that a user belongs to?

Path Finder

Our Active Directory logs contain a field called member_of and the value contains all the groups that a user is a member of. I would like to be able to create a report in table form using something similar to the values command listing each group a user is a member of.

The data is within the field is in the following format:

CN=XH_VI_Office,OU=GRP,OU=CO,DC=xmm,DC=local|CN=G_Ma43_Users_BYOD_Cloud_Users,OU=GRP,OU=CO,DC=xmm,DC=local|CN=XA_Outlook,OU=GRP,OU=CO,DC=xmm,DC=local|CN=G_GO_Win_SQL,OU=GRP,OU=CO,DC=xmm,DC=local|CN=AAG_GO_Admin,OU=Iox,OU=GRP,DC=xmm,DC=local|CN=XD_WIN,OU=GRP,OU=CO,DC=xmm,DC=local

I just want a list of all the CN values to be returned in a field as mentioned before in a list similar to the values command. Is this something that would be possible? Below is my current search which will let me know if the user is in the local admin group or domain admin group, but I want to expand it as mentioned above to show all groups.

index=windows sourcetype=ActiveDirectory sAMAccountType=805306368  | dedup name | eval localAdmin=if(like(memberOf,"%Local-Admin%"),"yes","no"), domainAdmin=if(like(memberOf,"%Domain Admins%"),"yes","no") | rename name AS userID, mail AS email, telephoneNumber AS phone,postalCode AS zip, l AS city | table userID,localAdmin,domainAdmin,displayName,email,phone,city,st,zip,OU,department,company
0 Karma
1 Solution

SplunkTrust
SplunkTrust

Try this.

index=windows sourcetype=ActiveDirectory sAMAccountType=805306368  | dedup name | rex field=test max_match=0 "CN=(?<memberOf>[^,]+)" | table userID, memberOf,displayName,email,phone,city,st,zip,OU,department,company
---
If this reply helps you, an upvote would be appreciated.

View solution in original post

SplunkTrust
SplunkTrust

Try this.

index=windows sourcetype=ActiveDirectory sAMAccountType=805306368  | dedup name | rex field=test max_match=0 "CN=(?<memberOf>[^,]+)" | table userID, memberOf,displayName,email,phone,city,st,zip,OU,department,company
---
If this reply helps you, an upvote would be appreciated.

View solution in original post

Path Finder

This works, thanks. Just had to change the field from test to the target field "memberOf

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!