I have been trying to extract a field to list domain admins from AD logs. The logs have all the admins starting with a CN= as shown in the expression. Despite working on regex101, the expression won't extract on Splunk. I've tried making little modifications but to no avail. Please help. Expression: source="ActiveDirectory" AND "CN=Domain Admins" AND member=* | rex field=_raw"(?<=CN=)[\w .]*(?=,)(?<admin>)/g"   The logs look similar to this: CN=Admin Account,OU=Vendor Accounts,OU=IT,DC=domain,DC=domain ... View more