Splunk Search

How to format distinguishedName to domain

Meloow
Engager

I am looking to format ldap extracted distinguishedName to a domain.

Example

CN=Username,OU=Folder,OU=Folder,DC=domain,DC=com

Output

domain.com

Labels (2)
0 Karma
1 Solution

isoutamo
SplunkTrust
SplunkTrust

Hi

one way to do it

| makeresults
| eval dn="CN=Username,OU=Folder,OU=Folder,DC=domain,DC=com"
| rex field=dn max_match=0 "(?ms)DC=(?<d1>[\w]+),DC=(?<d2>[\w]+)$"
| eval dn2=d1 .".". d2

r. Ismo 

View solution in original post

0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

one way to do it

| makeresults
| eval dn="CN=Username,OU=Folder,OU=Folder,DC=domain,DC=com"
| rex field=dn max_match=0 "(?ms)DC=(?<d1>[\w]+),DC=(?<d2>[\w]+)$"
| eval dn2=d1 .".". d2

r. Ismo 

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...