How to remove a field from WMI search query results in Splunk?

[anoopambli]

I have configured below query in wmi.conf

wql = select Caption,State from Win32_Service where Name like '%BlackBerry%'

Splunk is pulling up status of all Blackberry services correctly

8/11/14
11:48:57.079 AM

20140811114857.079470 Caption=BlackBerry Synchronization Service State=Running wmi_type=BlackBerryService

Only problem is when i table the output like | table host, Caption, State the result is coming up this way,
MCLCOVBB61VWIN BlackBerry Running

The service name is incomplete. What i found out was that, if i expand the fields in the original query, i see another field there with the name Caption which has only 'Blackberry' as the value.

How do i get rid of the second Caption field?

[somesoni2 · Accepted solution]

The reason you see incomplete value for Service Name/Caption fields is that there are multiple words in the value and its not enclosed within double qotes (and I don't think there is any options to enforce double quoted values from WMI queries), So workaround to this issue will by to extract full value for Caption fields.

This can be done at search query level like this

your base search | rex "Caption=(?<Caption>.*)(\r\n)"  | table host, Caption, State

OR

your base search | rex "Caption=(?<Caption>.*) State="  | table host, Caption, State

(see whichever works)

You can also, save the same regex as Search Time field extraction so that you don't have to write the regex in every search query.
http://docs.splunk.com/Documentation/Splunk/6.1.3/Knowledge/Addfieldsatsearchtime

[anoopambli]

That helped me. Thanks a ton.