Splunk Search

Regex help!

kranthi851
New Member

Hi
How can i extract a dn from the following result.

identity:
acd123
cn=abc,ou=..,ou=..,
xyz234
cn=acd,ou=abc,...

I need to extract a new field dn with values starting with cn=.

Tags (1)
0 Karma

sundareshr
Legend

Try this

your base search here | extract pairdelim="," kvdelim="=" | table cn ou 
0 Karma

MuS
Legend

Hi kranthi851,

try this regex:

 your base search here | rex max_match=0 "cn=(?<myNewField>[^,]+)" | do more here ....

The new field will be called myNewField just change it to what fits your use case.

Hope this helps ...

cheers, MuS

Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...