Splunk Search

regex to split names extracted from a string

nathanluke86
Communicator

This is a little tricky to explain but I have this query:

index = active_directory directReports=* sAMAccountName=* 
| rex field=directReports max_match=0 "CN=(?<memberOf>[^,]+)"
| rex field=memberOf mode=sed "s/\./ /g"
| rename sAMAccountName as Manager memberOf as Employee
| table Manager Employee

This displays as manager in column 1 and lists employees in column 2 :

How can I unlist the employees as separate rows as follows

Manager employee
Manager employee
Manager employee
Manager employee

TIA

Tags (2)
0 Karma

manjunathmeti
Champion

You just need to expand Employee fields values:

index = active_directory directReports=* sAMAccountName=* 
| rex field=directReports max_match=0 "CN=(?<memberOf>[^,]+)"
| rex field=memberOf mode=sed "s/\./ /g"
| rename sAMAccountName as Manager memberOf as Employee
| mvexpand Employee
| table Manager Employee

nathanluke86
Communicator

Thanks @manjunathmeti

0 Karma
Get Updates on the Splunk Community!

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...

4 Ways the Splunk Community Helps You Prepare for .conf25

.conf25 is right around the corner, and whether you’re a first-time attendee or a seasoned Splunker, the ...