topic Remove everything before backslash in string? in Dashboards & Visualizations

Remove everything before backslash in string?

Nomarja — Thu, 25 Nov 2021 12:08:57 GMT

I am trying to remove some unwanted characters before the backslash, but it is ignoring some machines as they have different name standards.

I want to remove the domain name and machine name from the Local Administrator group.

My data comes like this in one string as below

labmachine000r\administrator labmachine000d\support labdomain\admingroup labdomain\helpdesk

I managed to remove the characters before the backslash using this

| eval adminlocal=replace(adminlocal, "\w+(\\\\)+","")

and my result is like below:

administrator support admingroup helpdesk

That is working fine for the machine above, but if I have a machine name like "L-02labmachine000r", the replace command gives the result like this:

L-administrator L-support admingroup helpdesk

Is there any way to adjust my replace command to cover that machine name?

Re: Remove everything before backslash in string?

Gr0und_Z3r0 — Thu, 25 Nov 2021 12:37:29 GMT

Something like this....

| makeresults
| eval adminlocal = "labmachine000r\administrator labmachine000d\support labdomain\admingroup labdomain\helpdesk"
| eval adminlocal=replace(adminlocal, "\w+(\\\\)+","")
| eval mc = "L-02labmachine000r\administrator L-02labmachine000r\support L-02labmachine000r\admingroup L-02labmachine000r\helpdesk labdomain\admingroup labdomain\helpdesk L-99labmachine000r\admingroup L-0216labmachine000r\helpdesk"
| eval new_mc=replace(mc,"[\w\d\-]+(\\\)+","")

Please upvote if it helps.

Re: Remove everything before backslash in string?

Nomarja — Thu, 25 Nov 2021 12:39:04 GMT

Thanks @Gr0und_Z3r0 , that did the trick. I appreciate your help

Re: Remove everything before backslash in string?

Gr0und_Z3r0 — Thu, 25 Nov 2021 12:39:46 GMT

Cheers mate. Happy Splunking!