I am trying to remove some unwanted characters before the backslash, but it is ignoring some machines as they have different name standards. I want to remove the domain name and machine name from the Local Administrator group.  My data comes like this in one string as below labmachine000r\administrator labmachine000d\support  labdomain\admingroup labdomain\helpdesk I managed to remove the characters before the backslash using this   | eval adminlocal=replace(adminlocal, "\w+(\\\\)+","")   and my result is like below: administrator support  admingroup helpdesk That is working fine for the machine above, but if I have a machine name like "L-02labmachine000r", the replace command gives the result like this: L-administrator L-support admingroup helpdesk Is there any way to adjust my replace command to cover that machine name?     ... View more