- Splunk Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Re: Trim an entry for field extraction
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
how would I take an entry like this.
Member ID: CN=Test audit,OU=Users,OU=Office,OU=State,DC=domain,DC=local
and make it look like this....
Test audit
In a report generated in an e-mail? I'd like to trim it up.
Here's my original search
source="WinEventLog:Security" OR source="WinEventLog:Application" OR source="WinEventLog:system" EventCode "632" OR "633" OR "660" OR "661" OR "636" OR "637" "Domain Admins" OR "Account Operators" OR "Administrators" OR "Backup Operators" OR "Guests" OR "Network Configuration Operators" OR "Print Operators" OR "Remote Desktop Users" OR "Server Operators" OR "Users" OR "DNSAdmins" OR "DnsUpdateProxy" OR "Domain Guests" OR "Enterprise Admins" OR "Group Policy Creator Owners" OR "Schema Admins" |convert ctime(_time) AS Time | table Time,User,Target_Account_Name,Member_Name,Added_Removed | rename User to "Change Made By", Target_Account_Name to "Global Group", Member_Name to "Account Affected", Added_Removed to "Status" | rex "CN=(?[^,]+),"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Have you tried with a rex field extraction?
| rex "CN=(?<out>[^,]+),"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Have you tried with a rex field extraction?
| rex "CN=(?<out>[^,]+),"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
CN= does appear twice. I did already try rex field=Member_Name "CN=(?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
bshuford, please post your full search in your original question instead of putting it in a comment for readability. (Use the "edit" link under your question at the top.) Also, you could try adding "field" to your rex command, like so: rex field=Member_ID "CN=(?<out>[^,]+), but that shouldn't be necessary unless "CN=" appears multiple times in your event.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
That works, too. Way easier. =P
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Given your sample data, this will create a field called out that has a value of Test audit.
... | eval tmp=split(myfield, ",") | eval out=substr(mvfilter(match(tmp,"CN=")),15)
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Not sure, but the rex solution Paolo provided would be much easier.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
OH, the other question is, what is the 15? Counting 15 Characters from the CN=? If so what if the name is longer?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
OK, I get this, but it's not working.
Here is what I put in the end of my search
| eval tmp=split(Target_Account_Name, ",") | eval out=substr(mvfilter(match(tmp,"CN=")),15)
What am I doing wrong?
Detecting Remote Code Executions With the Splunk Threat Research Team
Observability | Use Synthetic Monitoring for Website Metadata Verification
More Ways To Control Your Costs With Archived Metrics | Register for Tech Talk
