https://community.splunk.com/t5/Splunk-Enterprise-Security/Regex-for-CEF/m-p/576932#M10475 <P>Bunch of different ways. Here's one:</P><P>| makeresults<BR />| eval _raw="CEF:0|vendor|product|1.1|1234|PolicyAssetUpdated|1|cn1label=EventUserId cn1=-3 cs1label=EventUserDisplayName cs1=Automated System cs2label=EventUserDomainName cs2= cn2label=AssetId cn2=20888 cs3label=AssetName cs3=ABCDPQRS.domain.com cn3label=DirectoryId cn3=856 cs4label=DirectoryName cs4=Active Directory cs5label=DomainName cs5=domain.com"<BR />| rex field=_raw "^.*?\|(?&lt;_raw&gt;cn1label.*)"<BR />| rex field=_raw mode=sed "s/\s?c[n|s]\d+label\=/;/g"<BR />| rex field=_raw mode=sed "s/\s?c[n|s]\d+\=/:/g"<BR />| extract pairdelim=";",kvdelim=":"<BR />| table AssetId AssetName DirectoryId DirectoryName DomainName EventUserId EventUserDisplayName EventUserDomainName</P> Wed, 01 Dec 2021 18:26:35 GMT johnhuang 2021-12-01T18:26:35Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Regex-for-CEF/m-p/576930#M10474 <P>Hi SMEs,</P><P>&nbsp;</P><P>I am trying to write regex to parse/map CEF format fields as below. so that all corresponding fieldname can capture values, i am not able to capture values having spaces in between. Seeking suggestion. Attached snap shot for ref.</P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="regex101" style="width: 999px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/17078i49EE595337064B90/image-size/large?v=v2&amp;px=999" role="button" title="CEF Regex.JPG" alt="regex101" /><span class="lia-inline-image-caption" onclick="event.preventDefault();">regex101</span></span></P><P>c[n|s]\dlabel\=(\w+).*?c[n|s]\d\=([\.a-zA-Z0-9_-]+)</P><P>&nbsp;</P><P>CEF:0|vendor|product|1.1|1234|PolicyAssetUpdated|1|cn1label=EventUserId cn1=-3 cs1label=EventUserDisplayName cs1=Automated System cs2label=EventUserDomainName cs2= cn2label=AssetId cn2=20888 cs3label=AssetName cs3=ABCDPQRS.domain.com cn3label=DirectoryId cn3=856 cs4label=DirectoryName cs4=Active Directory cs5label=DomainName cs5=domain.com</P> Wed, 01 Dec 2021 18:02:39 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Regex-for-CEF/m-p/576930#M10474 pavanbmishra 2021-12-01T18:02:39Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Regex-for-CEF/m-p/576932#M10475 <P>Bunch of different ways. Here's one:</P><P>| makeresults<BR />| eval _raw="CEF:0|vendor|product|1.1|1234|PolicyAssetUpdated|1|cn1label=EventUserId cn1=-3 cs1label=EventUserDisplayName cs1=Automated System cs2label=EventUserDomainName cs2= cn2label=AssetId cn2=20888 cs3label=AssetName cs3=ABCDPQRS.domain.com cn3label=DirectoryId cn3=856 cs4label=DirectoryName cs4=Active Directory cs5label=DomainName cs5=domain.com"<BR />| rex field=_raw "^.*?\|(?&lt;_raw&gt;cn1label.*)"<BR />| rex field=_raw mode=sed "s/\s?c[n|s]\d+label\=/;/g"<BR />| rex field=_raw mode=sed "s/\s?c[n|s]\d+\=/:/g"<BR />| extract pairdelim=";",kvdelim=":"<BR />| table AssetId AssetName DirectoryId DirectoryName DomainName EventUserId EventUserDisplayName EventUserDomainName</P> Wed, 01 Dec 2021 18:26:35 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Regex-for-CEF/m-p/576932#M10475 johnhuang 2021-12-01T18:26:35Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Regex-for-CEF/m-p/576971#M10476 <P>Thanks&nbsp;<SPAN>johnhua,</SPAN></P><P>Could you please suggest me how this can be called out in props.conf &amp; transforms.conf please</P> Thu, 02 Dec 2021 03:58:53 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Regex-for-CEF/m-p/576971#M10476 pavanbmishra 2021-12-02T03:58:53Z