Splunk Search

Remove CN= string and the rest from my search results

jnahuelperez35
Path Finder

Hi guys!

I'm loking for a search like this:

source="WinEventLog:Security" name = "A member *group*" Group_Name="*admin*" |
table _time src_user user Group_Name name

The search works great! the problem are the results, the "user" Column give me something like this:

CN=MyUserDomain,OU=SomeOrgUnit,OU=SomeOrgUnit,OU=SomeOrgUnit,OU=SomeOrgUnit,OU=SomeOrgUnit,DC=com,DC=net

I only wants to get "MyUserDomain". Is there anyway? I tried with eval user = trim(replace(user, "CN=", "")) but it only removes the first part of the string

Thanks a Lot!

Nahuel

0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

Try this

source="WinEventLog:Security" name = "A member *group*" Group_Name="*admin*" |
 table _time src_user user Group_Name name |
 eval user=replace(user,"CN=([^,]+),.+","\1")

View solution in original post

somesoni2
SplunkTrust
SplunkTrust

Try this

source="WinEventLog:Security" name = "A member *group*" Group_Name="*admin*" |
 table _time src_user user Group_Name name |
 eval user=replace(user,"CN=([^,]+),.+","\1")

jnahuelperez35
Path Finder

Thanks a Lot! where can i learn more about regular expressions codification like this?

Again, thanks!

Nahuel

0 Karma

GnanasekarP
New Member

Hi jnahuelperez, As our friend send you them in Splunk documentation if need detail explanation, I have learned from this links i hope this helps you: https://dzone.com/articles/starting-with-regular-expression-in-splunk & https://mindmajix.com/splunk

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Splunk provides some level of information about REGEX that you can use here
https://docs.splunk.com/Documentation/Splunk/6.5.3/Knowledge/AboutSplunkregularexpressions

If you google you can definitely find some external resources like this
http://www.learnsplunk.com/splunk-regex-tutorial.html

For practicing/testing, I use https://regex101.com/ site.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...