How to format distinguishedName to domain

[Meloow]

I am looking to format ldap extracted distinguishedName to a domain.

Example

CN=Username,OU=Folder,OU=Folder,DC=domain,DC=com

Output

domain.com

[isoutamo · Accepted solution]

Hi

one way to do it

| makeresults
| eval dn="CN=Username,OU=Folder,OU=Folder,DC=domain,DC=com"
| rex field=dn max_match=0 "(?ms)DC=(?<d1>[\w]+),DC=(?<d2>[\w]+)$"
| eval dn2=d1 .".". d2

r. Ismo