Splunk Search

Remove CN= string and the rest from my search results

jnahuelperez35
Path Finder

Hi guys!

I'm loking for a search like this:

source="WinEventLog:Security" name = "A member *group*" Group_Name="*admin*" |
table _time src_user user Group_Name name

The search works great! the problem are the results, the "user" Column give me something like this:

CN=MyUserDomain,OU=SomeOrgUnit,OU=SomeOrgUnit,OU=SomeOrgUnit,OU=SomeOrgUnit,OU=SomeOrgUnit,DC=com,DC=net

I only wants to get "MyUserDomain". Is there anyway? I tried with eval user = trim(replace(user, "CN=", "")) but it only removes the first part of the string

Thanks a Lot!

Nahuel

0 Karma
1 Solution

somesoni2
Revered Legend

Try this

source="WinEventLog:Security" name = "A member *group*" Group_Name="*admin*" |
 table _time src_user user Group_Name name |
 eval user=replace(user,"CN=([^,]+),.+","\1")

View solution in original post

somesoni2
Revered Legend

Try this

source="WinEventLog:Security" name = "A member *group*" Group_Name="*admin*" |
 table _time src_user user Group_Name name |
 eval user=replace(user,"CN=([^,]+),.+","\1")

jnahuelperez35
Path Finder

Thanks a Lot! where can i learn more about regular expressions codification like this?

Again, thanks!

Nahuel

0 Karma

GnanasekarP
New Member

Hi jnahuelperez, As our friend send you them in Splunk documentation if need detail explanation, I have learned from this links i hope this helps you: https://dzone.com/articles/starting-with-regular-expression-in-splunk & https://mindmajix.com/splunk

0 Karma

somesoni2
Revered Legend

Splunk provides some level of information about REGEX that you can use here
https://docs.splunk.com/Documentation/Splunk/6.5.3/Knowledge/AboutSplunkregularexpressions

If you google you can definitely find some external resources like this
http://www.learnsplunk.com/splunk-regex-tutorial.html

For practicing/testing, I use https://regex101.com/ site.

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...