https://community.splunk.com/t5/Splunk-Search/Regex-help/m-p/203379#M59099 <P>Hi kranthi851,</P> <P>try this regex:</P> <PRE><CODE> your base search here | rex max_match=0 "cn=(?&lt;myNewField&gt;[^,]+)" | do more here .... </CODE></PRE> <P>The new field will be called <CODE>myNewField</CODE> just change it to what fits your use case.</P> <P>Hope this helps ...</P> <P>cheers, MuS</P> Tue, 02 Aug 2016 21:34:16 GMT MuS 2016-08-02T21:34:16Z https://community.splunk.com/t5/Splunk-Search/Regex-help/m-p/203378#M59098 <P>Hi <BR /> How can i extract a dn from the following result.</P> <P>identity:<BR /> acd123<BR /> cn=abc,ou=..,ou=.., <BR /> xyz234<BR /> cn=acd,ou=abc,...</P> <P>I need to extract a new field dn with values starting with cn=.</P> Tue, 02 Aug 2016 21:29:46 GMT https://community.splunk.com/t5/Splunk-Search/Regex-help/m-p/203378#M59098 kranthi851 2016-08-02T21:29:46Z https://community.splunk.com/t5/Splunk-Search/Regex-help/m-p/203379#M59099 <P>Hi kranthi851,</P> <P>try this regex:</P> <PRE><CODE> your base search here | rex max_match=0 "cn=(?&lt;myNewField&gt;[^,]+)" | do more here .... </CODE></PRE> <P>The new field will be called <CODE>myNewField</CODE> just change it to what fits your use case.</P> <P>Hope this helps ...</P> <P>cheers, MuS</P> Tue, 02 Aug 2016 21:34:16 GMT https://community.splunk.com/t5/Splunk-Search/Regex-help/m-p/203379#M59099 MuS 2016-08-02T21:34:16Z https://community.splunk.com/t5/Splunk-Search/Regex-help/m-p/203380#M59100 <P>Try this</P> <PRE><CODE>your base search here | extract pairdelim="," kvdelim="=" | table cn ou </CODE></PRE> Tue, 02 Aug 2016 21:44:05 GMT https://community.splunk.com/t5/Splunk-Search/Regex-help/m-p/203380#M59100 sundareshr 2016-08-02T21:44:05Z