Can you help me create the regex that captures a string with a space in it?

[jip31]

Hello

I have a field with a space in the string :

Model=WDC WD5000LPLX-60ZNTT1

But SPLUNK displays only the characters WDC because of the space.

I need a regex please which displays WDC WD5000LPLX-60ZNTT1 (so with the space) but that will be readable by Splunk.

Thanks!

[MathiasLindblom · Accepted solution]

If we assume that whatever comes after Model= is fixed, eg:

Model=WDC WD5000LPLX-60ZNTT1 Test=XYZ

You could use a lookahead to "Test" like this:

    Model=(?P<Model>.*(?!Test))\s

Hope this could help, otherwise it would help with the entire event as mentioned before.

[jip31]

I done | rex field=Caption "(?P(?!Test))\s" but i have the message⚠ Error in 'rex' command: Encountered the following error while compiling the regex '(?P(?!Test))\s': Regex: unrecognized character after (?P

[MathiasLindblom]

If the event is on one line, you can use this:

| rex field=_raw "Model=(?P<Model>.*?)\sName"

[jip31]

perfect thanks

[MathiasLindblom]

Hi,

seems like I lost a few characters when posting. If the event are as you described above, where they are all on each line, this regex should work:

| rex field=_raw "Model=(?P<Model>[^\n]*)"

[woodcock]

we need to see the entire event (preferably several of them).

[jip31]

here is an example of one event fields
20181121161210.530611
Caption=WDC WD5000LPLX-60ZNTT1
DeviceID=\.\PHYSICALDRIVE0
FirmwareRevision=02.01A02
Model=WDC WD5000LPLX-60ZNTT1
Name=\.\PHYSICALDRIVE0
Size=500105249280
Status=OK
wmi_type=DiskDrive