Archive

Simple regex

Path Finder

I'm just trying to get the CN name from what looks like the fields below
CN=John Smith,OU=Customer Service,OU=Users,OU=UK,DC=COMPANY,DC=LOCAL
CN=John Jr. Smith,OU=VIPs,OU=UK,DC=COMPANY,DC=LOCAL

I tried this

rex field=Name "CN=(?<Name>*),OU=" 

but didn't work out cause it kind of matches the last OU= instead of the first..

Tags (1)
0 Karma
1 Solution

SplunkTrust
SplunkTrust

I think a slightly more accurate regex would be CN=(?<cn>[^,]*), as this will capture any CNs within a CN, and not just OUs. It will also capture any CNs that have an O or U in them.

View solution in original post

SplunkTrust
SplunkTrust

I think a slightly more accurate regex would be CN=(?<cn>[^,]*), as this will capture any CNs within a CN, and not just OUs. It will also capture any CNs that have an O or U in them.

View solution in original post

Splunk Employee
Splunk Employee

try this one:

CN=(?<Name>[^OU]*),OU
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes
and swag!