Dashboards & Visualizations

remove CN and keep name of the account only

nomarja1
Explorer

How can I just keep the account name?

I tried with replace, but that didn't work, the way I want

Here is the search that I am using:

 

 

| makeresults
| eval Member="
CN=Domain Admins,OU=Users,DC=Lab,DC=com
CN=Account Report,OU=Users,DC=Lab,DC=com
CN=Report,OU=Users,DC=Lab,DC=com
CN=HelpDesk,OU=Users,DC=Lab,DC=com
"
|eval change=replace(Member,"CN=","")
| table Member,change

 

 

 

My goal is to keep the name of the account only, to be like:

Domain Admins
Account Report
Report
HelpDesk

 

Thanks in advance,

 

 

Labels (1)
Tags (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| rex max_match=0 "CN=(?<account>[^,]+),"

View solution in original post

nomarja1
Explorer

I added field=Member before max_match and it worked

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| rex max_match=0 "CN=(?<account>[^,]+),"

nomarja1
Explorer

Thanks @ITWhisperer .

 

Should I add the name of my field in there like this:

| makeresults 
| eval Member="CN=Domain Admins,OU=Groups,OU=Admin,DC=eu,DC=dsext,DC=susq,DC=com
CN=Enterprise Admins,OU=Groups,OU=Admin,DC=eu,DC=dsext,DC=susq,DC=com
CN=LNSS_MONITOR_USR,CN=Users,DC=eu,DC=dsext,DC=susq,DC=com
CN=backupacct,OU=Admin,DC=eu,DC=dsext,DC=susq,DC=com"

| rex max_match=0 "CN=(?<Member>[^,]+),"
0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...