Splunk Search

How to trim everything from a field after a comma

sawyer2624
Engager

I have a field that contains:

CN=Joe Smith,OU=Support,OU=Users,OU=CCA,OU=DTC,OU=ENT,DC=ent,DC=abc,DC=store,DC=corp

I'd like to trim off everything after the first comma.

This information can always be changing, so there is no set number of characters.

Thanks.

0 Karma
1 Solution

nickhills
Ultra Champion

Hi @sawyer2624
try

|rex field=yourfield "CN\=(?P<commonName>[^\,]+)"
If my comment helps, please give it a thumbs up!

View solution in original post

jpolvino
Builder

Using sed mode on rex is one way to do it:

| makeresults
| eval thefield="CN=Joe Smith,OU=Support,OU=Users,OU=CCA,OU=DTC,OU=ENT,DC=ent,DC=abc,DC=store,DC=corp"
| rex field=thefield mode=sed "s/([^,]+).*/\1/g"

This Run Anywhere example shows a replace in-situ, which has the side effect of forever altering "thefield" going forward.

See https://regex101.com/r/EHmicm/1

nickhills
Ultra Champion

Hi @sawyer2624
try

|rex field=yourfield "CN\=(?P<commonName>[^\,]+)"
If my comment helps, please give it a thumbs up!

sawyer2624
Engager

So that creates a new field just like I want it, but how do I get the original field out of the table?

0 Karma

nickhills
Ultra Champion
|rex field=yourfield "CN\=(?P<commonName>[^\,]+)"|fields - yourfield
If my comment helps, please give it a thumbs up!
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...