https://community.splunk.com/t5/Security/Parsing-remoteUser-header-value/m-p/460424#M10729 <P>I have Splunk 7 with SSO enabled. Is there any way to extract certain value remoteUser header? For example, I want to extract from header with content "CN=cnvalue,O=MYORG,C=US" the value of CN, so Splunk wiil use only "cnvalue" as remote user. I know this can be done by Apache, but is there any way to do it on Splunk's side?</P> Sun, 07 Jun 2020 18:04:26 GMT vzabawski 2020-06-07T18:04:26Z https://community.splunk.com/t5/Security/Parsing-remoteUser-header-value/m-p/460424#M10729 <P>I have Splunk 7 with SSO enabled. Is there any way to extract certain value remoteUser header? For example, I want to extract from header with content "CN=cnvalue,O=MYORG,C=US" the value of CN, so Splunk wiil use only "cnvalue" as remote user. I know this can be done by Apache, but is there any way to do it on Splunk's side?</P> Sun, 07 Jun 2020 18:04:26 GMT https://community.splunk.com/t5/Security/Parsing-remoteUser-header-value/m-p/460424#M10729 vzabawski 2020-06-07T18:04:26Z