Remove CN= string and the rest from my search results

[jnahuelperez35]

Hi guys!

I'm loking for a search like this:

source="WinEventLog:Security" name = "A member *group*" Group_Name="*admin*" |
table _time src_user user Group_Name name

The search works great! the problem are the results, the "user" Column give me something like this:

CN=MyUserDomain,OU=SomeOrgUnit,OU=SomeOrgUnit,OU=SomeOrgUnit,OU=SomeOrgUnit,OU=SomeOrgUnit,DC=com,DC=net

I only wants to get "MyUserDomain". Is there anyway? I tried with eval user = trim(replace(user, "CN=", "")) but it only removes the first part of the string

Thanks a Lot!

Nahuel

[somesoni2 · Accepted solution]

Try this

source="WinEventLog:Security" name = "A member *group*" Group_Name="*admin*" |
 table _time src_user user Group_Name name |
 eval user=replace(user,"CN=([^,]+),.+","\1")

[jnahuelperez35]

Thanks a Lot! where can i learn more about regular expressions codification like this?

Again, thanks!

Nahuel

[GnanasekarP]

Hi jnahuelperez, As our friend send you them in Splunk documentation if need detail explanation, I have learned from this links i hope this helps you: https://dzone.com/articles/starting-with-regular-expression-in-splunk & https://mindmajix.com/splunk

[somesoni2]

Splunk provides some level of information about REGEX that you can use here
https://docs.splunk.com/Documentation/Splunk/6.5.3/Knowledge/AboutSplunkregularexpressions

If you google you can definitely find some external resources like this
http://www.learnsplunk.com/splunk-regex-tutorial.html

For practicing/testing, I use https://regex101.com/ site.