I want to take a dataset of canonical names and project out the username and domain name. I have a working example - but have found out that it only works when CN and DC are capitalized.

| parse MemberName with "CN=" TargetUser "," * ",DC=" TargetDomain
| extend TargetDomain = replace_string(TargetDomain, ",DC=", ".")

As soon as CN or DC are not capitalized though, the expected columns are null. So I was attempting to work this out using

| parse-where kind=regex flags=i MemberName with

But could not get the capture groups to work. cn=(.*?), returned the entire string and I didn't make much progress.

Data set

<Data Name="MemberName">CN=test one,OU=-Level11,OU=Level12,OU=Level13,DC=Locale1,DC=boing,DC=com</Data>
<Data Name="MemberName">cn=test two,OU=Level21,OU=Leve22,DC=Locale2,DC=com</Data>
<Data Name="MemberName">cn=test three,OU=Level31,OU=Level32,dc=Locale3,dc=Locale31,dc=Locale32,dc=com</Data>

Expected output

TargetUser: test one, test two, test, three
TargetDomain: Locale1.boing.com, Locale2.com, Locale3.Locale31.Locale32.com

CodePudding user response：

you could try using RE2 flags (specifically: i = case insensitive):

datatable(input:string)
[
  '<Data Name="MemberName">CN=test one,OU=Level11,OU=Level12,OU=Level13,DC=Locale1,DC=boing,DC=com</Data>',
  '<Data Name="MemberName">cn=test two,OU=Level21,OU=Leve22,DC=Locale2,DC=com</Data>',
  '<Data Name="MemberName">cn=test three,OU=Level31,OU=Level32,dc=Locale3,dc=Locale31,dc=Locale32,dc=com</Data>',
]
| parse kind=regex flags=Ui input with * "CN=" TargetUser "(,OU=[^,] )*,DC=" TargetDomain "</Data>"
| project TargetUser, TargetDomain = replace_regex(TargetDomain, "(?i),dc=", ".")