Dashboards & Visualizations

remove CN and keep name of the account only

nomarja1
Explorer

How can I just keep the account name?

I tried with replace, but that didn't work, the way I want

Here is the search that I am using:

 

 

| makeresults
| eval Member="
CN=Domain Admins,OU=Users,DC=Lab,DC=com
CN=Account Report,OU=Users,DC=Lab,DC=com
CN=Report,OU=Users,DC=Lab,DC=com
CN=HelpDesk,OU=Users,DC=Lab,DC=com
"
|eval change=replace(Member,"CN=","")
| table Member,change

 

 

 

My goal is to keep the name of the account only, to be like:

Domain Admins
Account Report
Report
HelpDesk

 

Thanks in advance,

 

 

Labels (1)
Tags (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| rex max_match=0 "CN=(?<account>[^,]+),"

View solution in original post

nomarja1
Explorer

I added field=Member before max_match and it worked

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| rex max_match=0 "CN=(?<account>[^,]+),"

nomarja1
Explorer

Thanks @ITWhisperer .

 

Should I add the name of my field in there like this:

| makeresults 
| eval Member="CN=Domain Admins,OU=Groups,OU=Admin,DC=eu,DC=dsext,DC=susq,DC=com
CN=Enterprise Admins,OU=Groups,OU=Admin,DC=eu,DC=dsext,DC=susq,DC=com
CN=LNSS_MONITOR_USR,CN=Users,DC=eu,DC=dsext,DC=susq,DC=com
CN=backupacct,OU=Admin,DC=eu,DC=dsext,DC=susq,DC=com"

| rex max_match=0 "CN=(?<Member>[^,]+),"
0 Karma
Get Updates on the Splunk Community!

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...

Ready, Set, SOAR: How Utility Apps Can Up Level Your Playbooks!

 WATCH NOW Powering your capabilities has never been so easy with ready-made Splunk® SOAR Utility Apps. Parse ...