Splunk Search

regex to split names extracted from a string

Communicator

This is a little tricky to explain but I have this query:

index = active_directory directReports=* sAMAccountName=* 
| rex field=directReports max_match=0 "CN=(?<memberOf>[^,]+)"
| rex field=memberOf mode=sed "s/\./ /g"
| rename sAMAccountName as Manager memberOf as Employee
| table Manager Employee

This displays as manager in column 1 and lists employees in column 2 :

How can I unlist the employees as separate rows as follows

Manager employee
Manager employee
Manager employee
Manager employee

TIA

Tags (2)
0 Karma

Influencer

You just need to expand Employee fields values:

index = active_directory directReports=* sAMAccountName=* 
| rex field=directReports max_match=0 "CN=(?<memberOf>[^,]+)"
| rex field=memberOf mode=sed "s/\./ /g"
| rename sAMAccountName as Manager memberOf as Employee
| mvexpand Employee
| table Manager Employee

Communicator

Thanks @manjunathmeti

0 Karma