Splunk Search

How to trim everything from a field after a comma

sawyer2624
Engager

I have a field that contains:

CN=Joe Smith,OU=Support,OU=Users,OU=CCA,OU=DTC,OU=ENT,DC=ent,DC=abc,DC=store,DC=corp

I'd like to trim off everything after the first comma.

This information can always be changing, so there is no set number of characters.

Thanks.

0 Karma
1 Solution

nickhills
Ultra Champion

Hi @sawyer2624
try

|rex field=yourfield "CN\=(?P<commonName>[^\,]+)"
If my comment helps, please give it a thumbs up!

View solution in original post

jpolvino
Builder

Using sed mode on rex is one way to do it:

| makeresults
| eval thefield="CN=Joe Smith,OU=Support,OU=Users,OU=CCA,OU=DTC,OU=ENT,DC=ent,DC=abc,DC=store,DC=corp"
| rex field=thefield mode=sed "s/([^,]+).*/\1/g"

This Run Anywhere example shows a replace in-situ, which has the side effect of forever altering "thefield" going forward.

See https://regex101.com/r/EHmicm/1

nickhills
Ultra Champion

Hi @sawyer2624
try

|rex field=yourfield "CN\=(?P<commonName>[^\,]+)"
If my comment helps, please give it a thumbs up!

View solution in original post

sawyer2624
Engager

So that creates a new field just like I want it, but how do I get the original field out of the table?

0 Karma

nickhills
Ultra Champion
|rex field=yourfield "CN\=(?P<commonName>[^\,]+)"|fields - yourfield
If my comment helps, please give it a thumbs up!
0 Karma