Simple regex

[clymbouris]

I'm just trying to get the CN name from what looks like the fields below
CN=John Smith,OU=Customer Service,OU=Users,OU=UK,DC=COMPANY,DC=LOCAL
CN=John Jr. Smith,OU=VIPs,OU=UK,DC=COMPANY,DC=LOCAL

I tried this

rex field=Name "CN=(?<Name>*),OU=" 

but didn't work out cause it kind of matches the last OU= instead of the first..

[alacercogitatus · Accepted solution]

I think a slightly more accurate regex would be CN=(?<cn>[^,]*), as this will capture any CNs within a CN, and not just OUs. It will also capture any CNs that have an O or U in them.

[sbrant_splunk]

try this one:

CN=(?<Name>[^OU]*),OU