Splunk Search

How do I only show certain values in a field?

Dallastek
Explorer

I'm trying to group ldap log values. I have already listed them out from a comma separated value but, I'm having a hard time getting them the way I want them to display. I'm trying to create a new field and show just the CN
here is my query - sourcetype=mysearch user_ldap_user_attributes_memberOf=business_group1 | stats values(user_ldap_user_attributes_memberOf) as Group | makemv delim="," Group
here is my results-
CN=ExchangeUsers

OU=Groups
OU=business
DC=us
DC=ad
DC=corp
DC=com
CN=FAMS_Users
OU=Groups
OU=business
DC=us
DC=ad
DC=corp
DC=com
CN=EXCHANGE_ACTIVESYNC
OU=Dynagroups
OU=Enterprise Groups
DC=us
DC=ad
DC=corp
DC=com
CN=Tableau
OU=Groups
OU=business
DC=us
DC=ad
DC=corp
DC=com
CN=Web_Access
OU=Groups
OU=business
DC=us
DC=ad
DC=corp
DC=com

0 Karma
1 Solution

sundareshr
Legend

See of one of these give you what you're looking for

sourcetype=mysearch user_ldap_user_attributes_memberOf=business_group1 | stats values(user_ldap_user_attributes_memberOf) as Group | makemv delim="," Group | mvexpand Group | search Group="CN*"

*OR*

    sourcetype=mysearch user_ldap_user_attributes_memberOf=business_group1 | stats values(user_ldap_user_attributes_memberOf) as Group | makemv delim="," Group | eval Group=mvfilter(Group, "CN=")

View solution in original post

0 Karma

sundareshr
Legend

See of one of these give you what you're looking for

sourcetype=mysearch user_ldap_user_attributes_memberOf=business_group1 | stats values(user_ldap_user_attributes_memberOf) as Group | makemv delim="," Group | mvexpand Group | search Group="CN*"

*OR*

    sourcetype=mysearch user_ldap_user_attributes_memberOf=business_group1 | stats values(user_ldap_user_attributes_memberOf) as Group | makemv delim="," Group | eval Group=mvfilter(Group, "CN=")
0 Karma

Dallastek
Explorer

The first query worked like a charm. The second gave me an error "The arguments to the 'mvfilter' function are invalid."
Thanks! I was WAY over thinking it

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...