Hi guys!
I'm loking for a search like this:
source="WinEventLog:Security" name = "A member *group*" Group_Name="*admin*" |
table _time src_user user Group_Name name
The search works great! the problem are the results, the "user" Column give me something like this:
CN=MyUserDomain,OU=SomeOrgUnit,OU=SomeOrgUnit,OU=SomeOrgUnit,OU=SomeOrgUnit,OU=SomeOrgUnit,DC=com,DC=net
I only wants to get "MyUserDomain". Is there anyway? I tried with eval user = trim(replace(user, "CN=", "")) but it only removes the first part of the string
Thanks a Lot!
Nahuel
Try this
source="WinEventLog:Security" name = "A member *group*" Group_Name="*admin*" |
table _time src_user user Group_Name name |
eval user=replace(user,"CN=([^,]+),.+","\1")
Try this
source="WinEventLog:Security" name = "A member *group*" Group_Name="*admin*" |
table _time src_user user Group_Name name |
eval user=replace(user,"CN=([^,]+),.+","\1")
Thanks a Lot! where can i learn more about regular expressions codification like this?
Again, thanks!
Nahuel
Hi jnahuelperez, As our friend send you them in Splunk documentation if need detail explanation, I have learned from this links i hope this helps you: https://dzone.com/articles/starting-with-regular-expression-in-splunk & https://mindmajix.com/splunk
Splunk provides some level of information about REGEX that you can use here
https://docs.splunk.com/Documentation/Splunk/6.5.3/Knowledge/AboutSplunkregularexpressions
If you google you can definitely find some external resources like this
http://www.learnsplunk.com/splunk-regex-tutorial.html
For practicing/testing, I use https://regex101.com/ site.