findstr

Sorry, I missed that the attr number was the same. So will the sample text always have the ldap attribute names and values separated by white space? If so, something like this should work:

 
 when RULE_INIT { 
  
 set ::sample_input_string {ldap:attr:attr1 value1 ldap:attr:attr2 value21 ldap:attr:attr2 value22 ldap:attr:attr3 value3 .... etc} 
 log local0. "Sample input string: $::sample_input_string" 
  
  Get the "attribute attribute_value" from the original string 
 set ::matches [regexp -inline -all {ldap:attr:attr2\s[^\s]+} $::sample_input_string] 
 log local0. "\$::matches: $::matches" 
  
  Loop through each list item and parse the value 
 foreach ::str $::matches { 
 log local0. "\$::str=$::str, value=[lindex $::str 1]" 
 } 
 } 
 

Rule : Sample input string: ldap:attr:attr1 value1 ldap:attr:attr2 value21 ldap:attr:attr2 value22 ldap:attr:attr3 value3 .... etc

Rule : $::matches: {ldap:attr:attr2 value21} {ldap:attr:attr2 value22}

Rule : $::str=ldap:attr:attr2 value21, value=value21

Rule : $::str=ldap:attr:attr2 value22, value=value22

Aaron