how would I take an entry like this.
Member ID: CN=Test audit,OU=Users,OU=Office,OU=State,DC=domain,DC=local
and make it look like this....
Test audit
In a report generated in an e-mail?
I'd like to trim it up.
Here's my original search
source="WinEventLog:Security" OR source="WinEventLog:Application" OR source="WinEventLog:system" EventCode "632" OR "633" OR "660" OR "661" OR "636" OR "637" "Domain Admins" OR "Account Operators" OR "Administrators" OR "Backup Operators" OR "Guests" OR "Network Configuration Operators" OR "Print Operators" OR "Remote Desktop Users" OR "Server Operators" OR "Users" OR "DNSAdmins" OR "DnsUpdateProxy" OR "Domain Guests" OR "Enterprise Admins" OR "Group Policy Creator Owners" OR "Schema Admins" |convert ctime(_time) AS Time | table Time,User,Target_Account_Name,Member_Name,Added_Removed | rename User to "Change Made By", Target_Account_Name to "Global Group", Member_Name to "Account Affected", Added_Removed to "Status" | rex "CN=(?[^,]+),"
... View more