Remove everything before backslash in string?

[Nomarja]

I am trying to remove some unwanted characters before the backslash, but it is ignoring some machines as they have different name standards.

I want to remove the domain name and machine name from the Local Administrator group.

 My data comes like this in one string as below

labmachine000r\administrator labmachine000d\support  labdomain\admingroup labdomain\helpdesk

I managed to remove the characters before the backslash using this

| eval adminlocal=replace(adminlocal, "\w+(\\\\)+","")

and my result is like below:

administrator support  admingroup helpdesk

That is working fine for the machine above, but if I have a machine name like "L-02labmachine000r", the replace command gives the result like this:

L-administrator L-support admingroup helpdesk

Is there any way to adjust my replace command to cover that machine name?

[Nomarja]

Thanks @Gr0und_Z3r0 , that did the trick. I appreciate your help

[Gr0und_Z3r0]

Cheers mate. Happy Splunking!

[Gr0und_Z3r0 · Accepted solution]

Something like this....

| makeresults
| eval adminlocal = "labmachine000r\administrator labmachine000d\support labdomain\admingroup labdomain\helpdesk"
| eval adminlocal=replace(adminlocal, "\w+(\\\\)+","")
| eval mc = "L-02labmachine000r\administrator L-02labmachine000r\support L-02labmachine000r\admingroup L-02labmachine000r\helpdesk labdomain\admingroup labdomain\helpdesk L-99labmachine000r\admingroup L-0216labmachine000r\helpdesk"
| eval new_mc=replace(mc,"[\w\d\-]+(\\\)+","")

Please upvote if it helps.