LDAP Search with REGEX to table out members of specific groups

[silversides]

Trying to build a search that will leverage ldapsearch to pull a current list of users that are members of a specific list of groups.  For example some groups may be

CN=Schema Admins,OU=groups,DC=domain,DC=xxx
CN=Enterprise Admins,OU=group1,OU=groups,DC=domain,DC=xxx
CN=Domain Admins Admins,OU=group1,OU=groups,DC=domain,DC=xxx

This rex (?<=CN=)[^,]+ will grab the group name but having trouble pulling this all together

This needs to search any group we want to include by specific name and then table out a list of the users that are members of each group sorted by the group name

[yuanliu]

---

This needs to search any group we want to include by specific name and then table out a list of the users that are members of each group sorted by the group name

---

First, you need to illustrate how a user is represented in Splunk data.  Is memberOf already extracted into one string?   Second, you need to illustrate what is the form of that "specific name" by which you wish to use in Splunk search.  As your example LDAP search indicates, LDAP group is more than just CN, but a group of attributes strung together as a unique identifier.  Are you going to search only by CN?

[silversides]

Appreciate the link, I'll have to dig into that 

I was hoping to get a working example here though that I could use and customize on my own

[silversides]

if this helps, this is how we currently list the members of a specific AD Group
ldapsearch search="(&(objectClass=user)(memberOf=CN=Schema Admins,OU=groups,DC=domain,DC=xxx))"

[ITWhisperer]

Search for all your users then extract the CN using the rex.

If you are trying the tighten your search criteria, here is the spec for searches https://datatracker.ietf.org/doc/html/rfc2254

[silversides]

Example table output would be something like

User1  Schema Admins
User2  Schema Admins
User1  Enterprise Admins
User3  Domain Admins

[ITWhisperer]

You are almost there - assuming your field is _raw

| rex "(?<groups>(?<=CN=)[^,]+)"

[ITWhisperer]

The rex "grabs" the CN - is this what you want to search for?

Please can you give examples of what you are trying to "grab" from these strings?