Splunk Search

I need help with rex ad DN field.

karu0711
Communicator

my DN field value "cn=jsuwus, jkhzdhkjc,ou=sdsfefv accounts,ou=ffdsrew users,dc=hgsywy,dc=tre,dc=hyt,dc=kuhytr"
I need rex to extract anything after "="and end ",ou=" if it see "=" need to stop two letter and "," so in this instance
cn field as "first_field" value="jsuwus, jkhzdhkjc" 
ou field as "2_field" value="sdsfefv accounts"
ou field as "3_field" value="ffdsrew users"
dc field as "4_field" value="hgsywy"
dc field as "5_field" value="tre"
dc field as "6_field" value="hyt"
dc field as "7_field" value=kuhytr"

Thanks in advance

Labels (2)
0 Karma

PickleRick
SplunkTrust
SplunkTrust

OK. Let me stop you right there.

1. It is of course a DN - it has its fields. Why do you want to lose that information?

2. Remember that LDAP DN can have properly escaped commas or equal signs.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try something like this

| makeresults
| eval dn="cn=jsuwus, jkhzdhkjc,ou=sdsfefv accounts,ou=ffdsrew users,dc=hgsywy,dc=tre,dc=hyt,dc=kuhytr"
| rex field=dn "cn=(?<cn>[^=]+)(?<!,)(?<!o)(?<!u)"
| rex field=dn max_match=0 "ou=(?<ou>[^=]+)(?<!,)(?<!o|d)(?<!u|c)"
| rex field=dn max_match=0 "dc=(?<dc>[^=]+)(?<!,)(?<!d)(?<!c)"
0 Karma
Get Updates on the Splunk Community!

Get ready to show some Splunk Certification swagger at .conf24!

Dive into the deep end of data by earning a Splunk Certification at .conf24. We're enticing you again this ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Now On-Demand Join us to learn more about how you can leverage Service Level Objectives (SLOs) and the new ...

Database Performance Sidebar Panel Now on APM Database Query Performance & Service ...

We’ve streamlined the troubleshooting experience for database-related service issues by adding a database ...