https://community.splunk.com/t5/Splunk-Search/Remove-CN-string-and-the-rest-from-my-search-results/m-p/367687#M108426 <P>Hi jnahuelperez, As our friend send you them in Splunk documentation if need detail explanation, I have learned from this links i hope this helps you: <A href="https://dzone.com/articles/starting-with-regular-expression-in-splunk">https://dzone.com/articles/starting-with-regular-expression-in-splunk</A> &amp; <A href="https://mindmajix.com/splunk">https://mindmajix.com/splunk</A></P> Wed, 29 Aug 2018 10:18:21 GMT GnanasekarP 2018-08-29T10:18:21Z https://community.splunk.com/t5/Splunk-Search/Remove-CN-string-and-the-rest-from-my-search-results/m-p/367683#M108422 <P>Hi guys!</P> <P>I'm loking for a search like this:</P> <PRE><CODE>source="WinEventLog:Security" name = "A member *group*" Group_Name="*admin*" | table _time src_user user Group_Name name </CODE></PRE> <P>The search works great! the problem are the results, the "user" Column give me something like this:</P> <PRE><CODE>CN=MyUserDomain,OU=SomeOrgUnit,OU=SomeOrgUnit,OU=SomeOrgUnit,OU=SomeOrgUnit,OU=SomeOrgUnit,DC=com,DC=net </CODE></PRE> <P>I only wants to get "MyUserDomain". Is there anyway? I tried with <STRONG>eval user = trim(replace(user, "CN=", ""))</STRONG> but it only removes the first part of the string</P> <P>Thanks a Lot!</P> <P>Nahuel</P> Mon, 08 May 2017 14:12:21 GMT https://community.splunk.com/t5/Splunk-Search/Remove-CN-string-and-the-rest-from-my-search-results/m-p/367683#M108422 jnahuelperez35 2017-05-08T14:12:21Z https://community.splunk.com/t5/Splunk-Search/Remove-CN-string-and-the-rest-from-my-search-results/m-p/367684#M108423 <P>Try this</P> <PRE><CODE>source="WinEventLog:Security" name = "A member *group*" Group_Name="*admin*" | table _time src_user user Group_Name name | eval user=replace(user,"CN=([^,]+),.+","\1") </CODE></PRE> Mon, 08 May 2017 14:47:50 GMT https://community.splunk.com/t5/Splunk-Search/Remove-CN-string-and-the-rest-from-my-search-results/m-p/367684#M108423 somesoni2 2017-05-08T14:47:50Z https://community.splunk.com/t5/Splunk-Search/Remove-CN-string-and-the-rest-from-my-search-results/m-p/367685#M108424 <P>Thanks a Lot! where can i learn more about regular expressions codification like this?</P> <P>Again, thanks!</P> <P>Nahuel</P> Mon, 08 May 2017 15:43:31 GMT https://community.splunk.com/t5/Splunk-Search/Remove-CN-string-and-the-rest-from-my-search-results/m-p/367685#M108424 jnahuelperez35 2017-05-08T15:43:31Z https://community.splunk.com/t5/Splunk-Search/Remove-CN-string-and-the-rest-from-my-search-results/m-p/367686#M108425 <P>Splunk provides some level of information about REGEX that you can use here<BR /> <A href="https://docs.splunk.com/Documentation/Splunk/6.5.3/Knowledge/AboutSplunkregularexpressions">https://docs.splunk.com/Documentation/Splunk/6.5.3/Knowledge/AboutSplunkregularexpressions</A></P> <P>If you google you can definitely find some external resources like this<BR /> <A href="http://www.learnsplunk.com/splunk-regex-tutorial.html">http://www.learnsplunk.com/splunk-regex-tutorial.html</A></P> <P>For practicing/testing, I use <A href="https://regex101.com/">https://regex101.com/</A> site.</P> Mon, 08 May 2017 15:53:55 GMT https://community.splunk.com/t5/Splunk-Search/Remove-CN-string-and-the-rest-from-my-search-results/m-p/367686#M108425 somesoni2 2017-05-08T15:53:55Z https://community.splunk.com/t5/Splunk-Search/Remove-CN-string-and-the-rest-from-my-search-results/m-p/367687#M108426 <P>Hi jnahuelperez, As our friend send you them in Splunk documentation if need detail explanation, I have learned from this links i hope this helps you: <A href="https://dzone.com/articles/starting-with-regular-expression-in-splunk">https://dzone.com/articles/starting-with-regular-expression-in-splunk</A> &amp; <A href="https://mindmajix.com/splunk">https://mindmajix.com/splunk</A></P> Wed, 29 Aug 2018 10:18:21 GMT https://community.splunk.com/t5/Splunk-Search/Remove-CN-string-and-the-rest-from-my-search-results/m-p/367687#M108426 GnanasekarP 2018-08-29T10:18:21Z