In some logs i have ldap DNs which i want to slice a part out from it like the CN or the PATH without the DN. The DNs i have get potentially in different formats.
Format 1:
O=xxx\OU=yyy\OU=zzz\CN=xyz
Format 2:
\xxx\yyy\zzz
Format 3:
CN=xyz,OU=zzz,OU=yyy,O=xxx
I would like to parse the elements and get all elements minus the first one etc.
I presume a custom command or macro could help there but i really really hope someone has done something similar.
Most often, Splunk will auto-extract some parts of the DN. Format3 is most likely auto-extracted because of key value pairs. Format 2 is probably a near impossibility, since the data presented is probably of variable length, so extraction without separators won't happen. Format 1 could probably be done with a regex:
your_Search | rex field=_raw "CN=(?<cn>[\w\d\s]+)" | rex field=_raw "OU=(?<org_unit>[^=]*)="|eval ou = substr(org_unit,-2)| rex field=_raw "O=(?<o_unit>[^=])="|eval o = substr(o_unit,-2)| stats count values(ou) by cn, o
The evals are necessary because the matching will capture "OU" from the next string, prior to the =. All of these rex's could be put into props/tranforms to make the searches cleaner.
Most often, Splunk will auto-extract some parts of the DN. Format3 is most likely auto-extracted because of key value pairs. Format 2 is probably a near impossibility, since the data presented is probably of variable length, so extraction without separators won't happen. Format 1 could probably be done with a regex:
your_Search | rex field=_raw "CN=(?<cn>[\w\d\s]+)" | rex field=_raw "OU=(?<org_unit>[^=]*)="|eval ou = substr(org_unit,-2)| rex field=_raw "O=(?<o_unit>[^=])="|eval o = substr(o_unit,-2)| stats count values(ou) by cn, o
The evals are necessary because the matching will capture "OU" from the next string, prior to the =. All of these rex's could be put into props/tranforms to make the searches cleaner.