Splunk Search

regex to split names extracted from a string

nathanluke86
Communicator

This is a little tricky to explain but I have this query:

index = active_directory directReports=* sAMAccountName=* 
| rex field=directReports max_match=0 "CN=(?<memberOf>[^,]+)"
| rex field=memberOf mode=sed "s/\./ /g"
| rename sAMAccountName as Manager memberOf as Employee
| table Manager Employee

This displays as manager in column 1 and lists employees in column 2 :

How can I unlist the employees as separate rows as follows

Manager employee
Manager employee
Manager employee
Manager employee

TIA

Tags (2)
0 Karma

manjunathmeti
SplunkTrust
SplunkTrust

You just need to expand Employee fields values:

index = active_directory directReports=* sAMAccountName=* 
| rex field=directReports max_match=0 "CN=(?<memberOf>[^,]+)"
| rex field=memberOf mode=sed "s/\./ /g"
| rename sAMAccountName as Manager memberOf as Employee
| mvexpand Employee
| table Manager Employee

nathanluke86
Communicator

Thanks @manjunathmeti

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...