https://community.splunk.com/t5/Splunk-Search/How-to-format-distinguishedName-to-domain/m-p/586045#M204144 <P>I am looking to format ldap extracted&nbsp;distinguishedName to a domain.</P> <P>Example</P> <P>CN=Username,OU=Folder,OU=Folder,DC=domain,DC=com</P> <P>Output</P> <P>domain.com</P> Tue, 22 Feb 2022 16:57:58 GMT Meloow 2022-02-22T16:57:58Z https://community.splunk.com/t5/Splunk-Search/How-to-format-distinguishedName-to-domain/m-p/586045#M204144 <P>I am looking to format ldap extracted&nbsp;distinguishedName to a domain.</P> <P>Example</P> <P>CN=Username,OU=Folder,OU=Folder,DC=domain,DC=com</P> <P>Output</P> <P>domain.com</P> Tue, 22 Feb 2022 16:57:58 GMT https://community.splunk.com/t5/Splunk-Search/How-to-format-distinguishedName-to-domain/m-p/586045#M204144 Meloow 2022-02-22T16:57:58Z https://community.splunk.com/t5/Splunk-Search/How-to-format-distinguishedName-to-domain/m-p/586054#M204148 <P>Hi</P><P>one way to do it</P><LI-CODE lang="markup">| makeresults | eval dn="CN=Username,OU=Folder,OU=Folder,DC=domain,DC=com" | rex field=dn max_match=0 "(?ms)DC=(?&lt;d1&gt;[\w]+),DC=(?&lt;d2&gt;[\w]+)$" | eval dn2=d1 .".". d2</LI-CODE><P>r. Ismo&nbsp;</P> Tue, 22 Feb 2022 15:07:58 GMT https://community.splunk.com/t5/Splunk-Search/How-to-format-distinguishedName-to-domain/m-p/586054#M204148 isoutamo 2022-02-22T15:07:58Z