https://community.splunk.com/t5/Splunk-Search/How-to-use-a-trailing-space-in-a-string-in-a-search/m-p/594044#M206767 <P>Just to be clear, you want to keep the events with "credential.helper=" but not if the = is followed by space?</P><LI-CODE lang="markup">| regex _raw="credential.helper=" | regex _raw!="credential.helper= "</LI-CODE><P>&nbsp;</P> Mon, 18 Apr 2022 09:00:52 GMT ITWhisperer 2022-04-18T09:00:52Z https://community.splunk.com/t5/Splunk-Search/How-to-use-a-trailing-space-in-a-string-in-a-search/m-p/594003#M206763 <P>Hi all,</P> <P>I want to set a condition "credential.helper= ", notice there is a trailing space after the "=".&nbsp;</P> <P>What I want to achieve is to catch anything record that has "credential.helper=" and any value after "=" sign. So if there is only a trailing space, I can ignore it.</P> <P>How could I go about it in&nbsp; a search, please?</P> <P>Thanks,</P> <P>&nbsp;</P> Mon, 18 Apr 2022 15:23:19 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-a-trailing-space-in-a-string-in-a-search/m-p/594003#M206763 humblelearner 2022-04-18T15:23:19Z https://community.splunk.com/t5/Splunk-Search/How-to-use-a-trailing-space-in-a-string-in-a-search/m-p/594044#M206767 <P>Just to be clear, you want to keep the events with "credential.helper=" but not if the = is followed by space?</P><LI-CODE lang="markup">| regex _raw="credential.helper=" | regex _raw!="credential.helper= "</LI-CODE><P>&nbsp;</P> Mon, 18 Apr 2022 09:00:52 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-a-trailing-space-in-a-string-in-a-search/m-p/594044#M206767 ITWhisperer 2022-04-18T09:00:52Z https://community.splunk.com/t5/Splunk-Search/How-to-use-a-trailing-space-in-a-string-in-a-search/m-p/594159#M206795 <P>Thanks, I will give it a try</P> Mon, 18 Apr 2022 23:12:50 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-a-trailing-space-in-a-string-in-a-search/m-p/594159#M206795 humblelearner 2022-04-18T23:12:50Z