I have a field that contains:
CN=Joe Smith,OU=Support,OU=Users,OU=CCA,OU=DTC,OU=ENT,DC=ent,DC=abc,DC=store,DC=corp
I'd like to trim off everything after the first comma.
This information can always be changing, so there is no set number of characters.
Thanks.
Hi @sawyer2624
try
|rex field=yourfield "CN\=(?P<commonName>[^\,]+)"
Using sed mode on rex
is one way to do it:
| makeresults
| eval thefield="CN=Joe Smith,OU=Support,OU=Users,OU=CCA,OU=DTC,OU=ENT,DC=ent,DC=abc,DC=store,DC=corp"
| rex field=thefield mode=sed "s/([^,]+).*/\1/g"
This Run Anywhere example shows a replace in-situ, which has the side effect of forever altering "thefield" going forward.
Hi @sawyer2624
try
|rex field=yourfield "CN\=(?P<commonName>[^\,]+)"
So that creates a new field just like I want it, but how do I get the original field out of the table?
|rex field=yourfield "CN\=(?P<commonName>[^\,]+)"|fields - yourfield