You might want to get other things in there like the OU...
Here's an example of having multiple OU in the path, but extracting them separately as needed:
| makeresults count=1
| eval abc="CN=xxxxxxxx,OU=unit,OU=city,OU=group,DC=company,DC=com"
| makemv abc delim=","
| eval cn=mvindex(abc,0)
| eval unit=mvindex(abc,1)
| eval city=mvindex(abc,2)
| eval group=mvindex(abc,3)
| eval domain=mvindex(abc,4)
| eval tld=mvindex(abc,5)
Or maybe:
| makeresults count=1
| eval _raw="CN=xxxxxxxx,OU=unit,OU=city,OU=group,DC=company,DC=com"
| extract limit=0 mv_add=true
| mvexpand OU <- or table OU to see what you get
... View more