Splunk Search

Trim an entry for field extraction

bshuford
Path Finder

how would I take an entry like this.

Member ID: CN=Test audit,OU=Users,OU=Office,OU=State,DC=domain,DC=local

and make it look like this....

Test audit

In a report generated in an e-mail? I'd like to trim it up.

Here's my original search

source="WinEventLog:Security" OR source="WinEventLog:Application" OR source="WinEventLog:system" EventCode "632" OR "633" OR "660" OR "661" OR "636" OR "637" "Domain Admins" OR "Account Operators" OR "Administrators" OR "Backup Operators" OR "Guests" OR "Network Configuration Operators" OR "Print Operators" OR "Remote Desktop Users" OR "Server Operators" OR "Users" OR "DNSAdmins" OR "DnsUpdateProxy" OR "Domain Guests" OR "Enterprise Admins" OR "Group Policy Creator Owners" OR "Schema Admins" |convert ctime(_time) AS Time | table Time,User,Target_Account_Name,Member_Name,Added_Removed | rename User to "Change Made By", Target_Account_Name to "Global Group", Member_Name to "Account Affected", Added_Removed to "Status" | rex "CN=(?[^,]+),"

Tags (1)
1 Solution

Paolo_Prigione
Builder

Have you tried with a rex field extraction?

| rex "CN=(?<out>[^,]+),"

View solution in original post

Paolo_Prigione
Builder

Have you tried with a rex field extraction?

| rex "CN=(?<out>[^,]+),"

bshuford
Path Finder

CN= does appear twice. I did already try rex field=Member_Name "CN=(?[^,]+), that didn't work either. That's exactly what I was thinking.

0 Karma

Lowell
Super Champion

bshuford, please post your full search in your original question instead of putting it in a comment for readability. (Use the "edit" link under your question at the top.) Also, you could try adding "field" to your rex command, like so: rex field=Member_ID "CN=(?<out>[^,]+), but that shouldn't be necessary unless "CN=" appears multiple times in your event.

0 Karma

Ron_Naken
Splunk Employee
Splunk Employee

That works, too. Way easier. =P

0 Karma

Ron_Naken
Splunk Employee
Splunk Employee

Given your sample data, this will create a field called out that has a value of Test audit.

... | eval tmp=split(myfield, ",") | eval out=substr(mvfilter(match(tmp,"CN=")),15)

Ron_Naken
Splunk Employee
Splunk Employee

Not sure, but the rex solution Paolo provided would be much easier.

0 Karma

bshuford
Path Finder

OH, the other question is, what is the 15? Counting 15 Characters from the CN=? If so what if the name is longer?

0 Karma

bshuford
Path Finder

OK, I get this, but it's not working.
Here is what I put in the end of my search

| eval tmp=split(Target_Account_Name, ",") | eval out=substr(mvfilter(match(tmp,"CN=")),15)

What am I doing wrong?

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...