my DN field value "cn=jsuwus, jkhzdhkjc,ou=sdsfefv accounts,ou=ffdsrew users,dc=hgsywy,dc=tre,dc=hyt,dc=kuhytr"
I need rex to extract anything after "="and end ",ou=" if it see "=" need to stop two letter and "," so in this instance
cn field as "first_field" value="jsuwus, jkhzdhkjc"
ou field as "2_field" value="sdsfefv accounts"
ou field as "3_field" value="ffdsrew users"
dc field as "4_field" value="hgsywy"
dc field as "5_field" value="tre"
dc field as "6_field" value="hyt"
dc field as "7_field" value=kuhytr"
Thanks in advance
OK. Let me stop you right there.
1. It is of course a DN - it has its fields. Why do you want to lose that information?
2. Remember that LDAP DN can have properly escaped commas or equal signs.
Try something like this
| makeresults
| eval dn="cn=jsuwus, jkhzdhkjc,ou=sdsfefv accounts,ou=ffdsrew users,dc=hgsywy,dc=tre,dc=hyt,dc=kuhytr"
| rex field=dn "cn=(?<cn>[^=]+)(?<!,)(?<!o)(?<!u)"
| rex field=dn max_match=0 "ou=(?<ou>[^=]+)(?<!,)(?<!o|d)(?<!u|c)"
| rex field=dn max_match=0 "dc=(?<dc>[^=]+)(?<!,)(?<!d)(?<!c)"