Need to write both rex and regex

[vishwanadhan_mu]

"C:\Users\TestUser\AppData\Local\Microsoft\Teams\Update.exe" --processStart "Teams.exe" --process-start-args "--system-initiated"

Could someone help me writing regex and rex to extract field(which is a process) name after --processStart .

Next I'll filter out filed name which I don't want match.

Thanks in Advance

[jawaharas]

Try this.

Field extracted using space as delimiter.

| makeresults 
 | eval input="\"C:\Users\TestUser\AppData\Local\Microsoft\Teams\Update.exe\" --processStart \"Teams.exe\" --process-start-args \"--system-initiated\"" 
 | rex field=input "^(?:[^\s]* ){2}\"(?<process>[^ ]+)\""

[vishwanadhan_mu]

This too worked for me. Thanks a lot.

[vnravikumar · Accepted solution]

Hi

Try this

| makeresults 
| eval temp="\"C:\Users\TestUser\AppData\Local\Microsoft\Teams\Update.exe\" --processStart \"Teams.exe\" --process-start-args \"--system-initiated\"" 
| rex field=temp "--processStart\s\"(?P<processname>[^--]+)\""

[vishwanadhan_mu]

This worked. Thanks a lot

[vishwanadhan_mu]

If you don't mind can you explain me [^--]+)\"" this part

[vnravikumar]

I mentioned to extract from processStart to before --