regex to pull cn fields

[spluser1]

Hey everyone, 

I have this format - 

cn=<name>,ou=<>,ou=people,dc=<>,dc=<>,dc=<> that i'm pulling that i need to use only the cn= field. how can i do it with the regex command? is that possible?

thanks!!

[spluser1]

excellent, i see it now. works perfect. thanks!

[isoutamo]

As it solve you problem, please accept it as Solution so other can see it later.
Happy Splunking!

[spluser1]

thanks for the info.

when saying your existing field you mean to put the actual field that contain the format? also is there a way to save that so i could do a stats to show the output only with the cn value?

[isoutamo]

If you have extracted that whole value into some field (e.g. ldap_query) then use it. If that value is still in _raw then you could leave that field=xxxx part away. Just see https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Rex

[isoutamo]

Hi

you could use this

...
| rex field=<your existing field> "cn=(?<cn>[^,]+)"

r. Ismo

PS. regex101.com is excellent place to test these!