Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

How write the regular expression to extract different formats of the altSecurityIdentities attribute I'm querying in LDAP?

$
0
0
I am trying to extract text from a specific attribute that I am querying in LDAP. Our "altSecurityIdenities" attribute is not formatted the same on all users where the data in it either has an additional text string I want to capture or it doesn't. When I get it so it only selects the additional string, the other attributes that don't have that string are gathering too much, and if I fix it so the others capture less, so does my first example. Confused yet? {"altSecurityIdentities":["X509:C=US,O=Entrust,OU=Certification Authorities,OU=Entrust Managed Services SSP CAOID.0.9.2342.19200300.100.1.1=16651003215794 CN=DOE JANE (Affiliate)"]} {"altSecurityIdentities":["X509:C=US,O=Entrust,OU=Certification Authorities,OU=Entrust Managed Services SSP CACN=DOE JOHN OID.0.9.2342.19200300.100.1.1=16651002070291"]} Basically I'm trying to extract the name after `CN=`, but since the lines aren't structured the same way (OID value comes before CN in one event but not the other), I'm having trouble finding the balance where I can capture the extra string in one, but not gather the OID value of the other. I started with this simple regex: CN=[^"]+ While that captures `CN=DOE JANE (Affiliate)` correctly, it also captures `CN=DOE JOHN OID.0.9.2342.19200300.100.1.1=16651002070291` since the quotation is at the end of the query after the OID string on the other object. I know I'm missing something fairly simple, but I just can't seem to get it.

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>