Need help regex

pavanbmishra — Mon, 20 Dec 2021 17:48:13 GMT

We need to capture field value for the below CEF log pattern

CEF:0|vendor|product|1.1.0.15361|6099|DirectoryAssetSyncSucceeded|1|cn1label=EventUserId cn1=-3 cs1label=EventUserDisplayName cs1=Automated System cs2label=EventUserDomainName cs2= cn2label=AssetId cn2=16699 cs3label=AssetName cs3=ABC.LOCAL AD cn3label=AssetPartitionId cn3=7 cs4label=AssetPartitionName cs4=XYZ.LOCAL partition cs5label=TaskId cs5=9ec9aa87-61b9-11ec-926f-3123456edt

I am using the below regex

(?:([\d\w]+)label=(?<_KEY_1>\S+))(?=.*\1=(?<_VAL_1>[^=]+)(?=$|\s+[\w\d]+=))

Unfortunatelly it is not taking the blank one, like cs2= , which doesn't contain anything so EventUserDomainName should be blank

Kindly suggest

Re: Need help regex

ITWhisperer — Mon, 20 Dec 2021 18:13:31 GMT

(?:([\d\w]+)label=(?<_KEY_1>\S+))(?=.*\1=(?<_VAL_1>[^=]*?)(?=$|\s+[\w\d]+=))

topic Need help regex in Splunk Search

Need help regex

Re: Need help regex