Hello,
I have messages from Microsoft IIS where cs-username contain username with domain prefix like cs-username="test.com\john.smith" (this from SA transformation). Somebody know how I can cut "test.com\" from the message? I tried do it through xml parser, but parser works very stranger, for example meta username not have &qout; and I don't know how cut slash symbol. Maybe someone has this experience.
You can try and do the following :
cs-username="test.com\john.smith"
cs-username=<fld1>\<username>
essentially just placing a temporary value where the "test.com" is with the RSA xml usage of temporary value "fldX"