topic Regex Help in Splunk Search

Regex Help

mikefoti — Fri, 02 Dec 2011 13:48:21 GMT

A complete event record looks like this:

Row 114005: Requester Name: "RETAIL\S2343W01$" Issued Common Name: "S2343W01.retail.fakename.com" User Principal Name: "S2343W01.retail.fakename.com" Serial Number: "4c22be0100010002d317" Certificate Template: Client Authentication - Retail Desktops Certificate Effective Date: 12/1/2011 10:38 AM Certificate Expiration Date: 11/30/2012 10:38 AMMaximum Row Index: 114005

My Regex to capture a cert_SN field looks like this:

(?i)Serial Number: “(?P<cert_SN>.+?\n)

The result captures the seriel number PLUS the final quote i.e.

cert_SN = 4c22be0100010002d317"

How can I eliminate the final quote?

Re: Regex Help

_d_ — Fri, 02 Dec 2011 13:54:30 GMT

You can try either of these:

(?i)Serial Number:\s\"(?P<cert_sn>\w+)\"

(?i)Serial Number:\s\"(?P<cert_sn>\w+)

-->
EDIT: In case you need to capture empty fields then try this:

(?i)Serial Number:\s\"(?P<cert_sn>[^\"]*)\"

This will capture everything between "" even when there are no spaces between quotes. If you know for certain that there will be spaces between quotes then change * to +.

Hope this helps.

> please upvote and accept answer if you find it useful - thanks!

Re: Regex Help

mikefoti — Fri, 02 Dec 2011 14:18:56 GMT

both work equally well both both also fail to pick up a value of EMPTY... which is weird... seems like /w ought to match EMPTY or anyother word?!?!?