How to trim everything from a field after a comma

[sawyer2624]

I have a field that contains:

CN=Joe Smith,OU=Support,OU=Users,OU=CCA,OU=DTC,OU=ENT,DC=ent,DC=abc,DC=store,DC=corp

I'd like to trim off everything after the first comma.

This information can always be changing, so there is no set number of characters.

Thanks.

[jpolvino]

Using sed mode on rex is one way to do it:

| makeresults
| eval thefield="CN=Joe Smith,OU=Support,OU=Users,OU=CCA,OU=DTC,OU=ENT,DC=ent,DC=abc,DC=store,DC=corp"
| rex field=thefield mode=sed "s/([^,]+).*/\1/g"

This Run Anywhere example shows a replace in-situ, which has the side effect of forever altering "thefield" going forward.

See https://regex101.com/r/EHmicm/1

[nickhills · Accepted solution]

Hi @sawyer2624
try

|rex field=yourfield "CN\=(?P<commonName>[^\,]+)"

[sawyer2624]

So that creates a new field just like I want it, but how do I get the original field out of the table?

[nickhills]

|rex field=yourfield "CN\=(?P<commonName>[^\,]+)"|fields - yourfield