How to use a trailing space in a string in a search?

[humblelearner]

Hi all,

I want to set a condition "credential.helper= ", notice there is a trailing space after the "=". 

What I want to achieve is to catch anything record that has "credential.helper=" and any value after "=" sign. So if there is only a trailing space, I can ignore it.

How could I go about it in  a search, please?

Thanks,

[ITWhisperer]

Just to be clear, you want to keep the events with "credential.helper=" but not if the = is followed by space?

| regex _raw="credential.helper="
| regex _raw!="credential.helper= "

[humblelearner]

Thanks, I will give it a try