title: RegEx in Splunk Search
body: <p>I'm new to Splunk, as you'll see, but I have inherited trying to figure out an existing dashboard and to modify it. </p>
  
  <p>Existing Search:</p>
  
  <pre><code>"Policy_Name=Authentication EventCode=1   *$name$*  
  | eval TimeOfRequest= _time | table TimeOfRequest, ResultMessage, 
  |rex field=_raw (FullyQualifiedUserName=[^/]+$), Calling_Station_Identifier 
  | convert timeformat="%b %d, %Y %I:%M:%S %p" ctime(TimeOfRequest)"
  </code></pre>
  
  <p>Output:</p>
  
  <pre><code>TimeOfRequest Dec 10, 2015 11:04:16 AM
  ResultMessage User BobSmith was granted access.
  FullyQualifiedUserName domain.local/OU1/OU2/OU3/OU4/Smith, Bob
  Calling_Station_Identifier 192.168.1.1
  </code></pre>
  
  <p>I've been asked for a slight modification to the output. I need to cleanup the <code>FullyQualifiedUsername</code> by removing the full path with only leaving <code>Lastname</code>, <code>Firstname</code>, i.e. "Smith, Bob". I looked into running some sort of regex against the field, but I'm not yielding any results, just errors. </p>
  
  <p>Example of my queries below:</p>
  
  <pre><code>"Policy_Name=Authentication EventCode=1   *$name$* 
  | eval TimeOfRequest= _time 
  | table TimeOfRequest, ResultMessage, regex 
         (FullyQualifiedUserName = [^/]+$), Calling_Station_Identifier
  | convert timeformat="%b %d, %Y %I:%M:%S %p" ctime(TimeOfRequest)"
  </code></pre>
  
  <p>or</p>
  
  <pre><code>Policy_Name=Authentication EventCode=1   *$name$*  
  | eval TimeOfRequest= _time | table TimeOfRequest, ResultMessage, 
  | rex field=FullyQualifiedUserName "[^/]+$", Calling_Station_Identifier
  | convert timeformat="%b %d, %Y %I:%M:%S %p" ctime(TimeOfRequest)
  </code></pre>
  
  <p>Any help trying to figure this query would be much appreciated. </p>