It was included just to show the fact that the two log entries are identical except for the field value for User_Nameįeb 18 08:00:33 #src_ip# hostname='hostname',errdefs_msgno='989898989: 5:',partition_name='ptnname',session_id='00000000',Access_Profile='profile_name',Partition='partition_name',Session_Id='00000000',User_Name='shortname' I need to take the time, session_id and User_Name from the following log entry.įeb 18 08:00:33 #src_ip# hostname='hostname',errdefs_msgno='989898989: can ignore this entry. The problem being that they are values in the same field in virtually identical log entries.Īnd I should have mentioned that the groupname is pulled out via field extraction from the list of AD groups so is a field in itself. I need to create a report for someone analysing the data and they need it to include only the UPN format value and ignore the shortname. Other than that the two log entries are identical. The infrastructure writes both versions (to pass on both credential options). The UPN and shortname are the two options for values in the User_Name field. My sanitising of logs obviously hasn't helped. Thanks for your response again and sorry for the confusion. In your example, User_Name='shortname' in the second log entry.

You say you want User_Name and UPN, but not short_name. My earlier queries were fairly basic and didn't address the username a little confused from your message. I just wanted to create a table output showing the time the user connected, session_id, User_Name and UPN. The first (and second) is just the connection log with either the UPN or shortname as the User_Name value. The following are the two main log entries that I have to get the inform out of. But I only want to return the UPN format field value. One includes the shortname and one includes the UPN. The problem is there are two identical log entries created in this process. I don't actually want to get the shortname for the username. Thanks for your response and sorry for the delay getting back. | stats values(CN) as GroupName values(UPN) as UPN by _time, Session_Id | rex field=User_Name eval User_Name=if(isnull(UPN), User_Name, null()) See this example with your data | makeresults I am working on the assumption that the third log message is the data you want to get User_Name from and that is shown in your log as CN=groupname.

Splunk join by two fields