extract name from multivalue - Splunk Community

Splunk Search

Within MSAD, the manager field looks like this:

manager=CN=The Boss,OU=HLGIT,OU=CO,OU=mytownUsers,OU=ourFIRE,DC=ourcompany,DC=net

I need to extract "The Boss" only

Ideas?

Try

... | rex field=manager "CN=(?<CN>[^,]+)" | ...

---
If this reply helps you, Karma would be appreciated.

Get Updates on the Splunk Community!

Guided Onboarding with Auto-schema Is Now Generally Available

We are excited to announce the General Availability of Guided Onboarding with Auto-Schematization ...

ATTENTION: We’re Moving! (AGAIN!)

The Splunk Community Slack is undergoing a system migration to keep our workspace secure and ...

Deep Dive: Optimizing Telemetry Pipelines in Splunk Observability Cloud

In this session, we will peel back the layers of Splunk Observability Cloud’s cost-optimization features. ...