In Az Log Analytics, I am wanting to extract information from A DN
cn=User One,OU=Accounts,OU=Administrative,DC=internal,DC=local,DC=com
The goal is to extend to new columns: User = User One, Domain = internal.local.com
Haven't been able to find a good example to recreate this from in Kusto.
you could use the parse operator:
print input = 'cn=User One,OU=Accounts,OU=Administrative,DC=internal,DC=local,DC=com'
| parse input with "cn=" User "," * "DC=" d1 ",DC=" d2 ",DC=" d3
| project input, User, Domain = strcat_delim(".", d1, d2, d3)
| input | User | Domain |
|---|---|---|
| cn=User One,OU=Accounts,OU=Administrative,DC=internal,DC=local,DC=com | User One | internal.local.com |
Or, if there is a variable number of occurrences of DC=:
datatable(input:string) [
'cn=User One,OU=Accounts,OU=Administrative,DC=internal,DC=local,DC=com',
'cn=User One,OU=Accounts,OU=Administrative,DC=internal,DC=com',
]
| parse input with "cn=" User "," * ",DC=" Domain
| extend Domain = replace_string(Domain, ",DC=", ".")
| input | User | Domain |
|---|---|---|
| cn=User One,OU=Accounts,OU=Administrative,DC=internal,DC=local,DC=com | User One | internal.local.com |
| cn=User One,OU=Accounts,OU=Administrative,DC=internal,DC=com | User One | internal.com |