How to use rex to remove "domain\' from a username?

[pil321]

I have a field that looks like this:

UserName=domain\joe_user

I want it to look like this:

UserName=joe_user

How do I take out domain\ using rex?

[Dev_Choudhary]

try this

rex field=cs_userdn "\w+\\(?\S+)"

[woodcock]

Like this:

... | rex field=UserName mode=sed "s/[^\\\]*\\\//"

[somesoni2 · Accepted solution]

Try this

your base search | rex field=UserName "\w+\\(?<UserName>.*)"

OR

your base search | eval UserName=mvindex(split(UserName,"\\"),-1)