Quote delimited fields containing spaces

[kmattern]

In the past our iis logs were space delimited with the user agent field using the plus sign as an internal delimiter, such as

KRFU+(VER+5.0/5.0.2.v20130730-3038;+Win7+6.1;+52.4/2215/-1;Server+Atlanta;00222003D1C5;3238LB934)

But with the change in the log file format the user agent field now looks like this

"KRFU (VER 5.0/5.0.2.v20130920-3090; WinServer 2008 R2 6.1; 18.6/62/-1;Server Atlanta Metro;005056AA6ED5;sta001)"

"KRFU (VER 5.0/5.0.2.v20130920-3090; WinServer 2008 R2 6.1; 15.8/0/-1;New York All-Purpose Server;005056A4000B;ws120)"

One server is named "Server Atlanta Metro" which contains 3 spaces. The other server is named "New York All-Purpose Server" which contains 4 spaces. Sometimes the server will have only one name with no spaces. This causes problems with space delimited fields.

So how do I tell Splunk to consume everything between the quotes as one field?

[jtrucks]

Try this:

\"(?<useragent>.*)\"