extarct specific field with regex

[khanlarloo]

i want to extract the field with the name of http_agent from my logs
the raw field is :

"http_host=""nts.mapnanyp.com""","http_agent=""Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:62.0) Gecko/20100101 Firefox/62.0""",http_retcode=200,"msg=""HTTP get request from,content_switch_name="none",server_pool_name="NTS","user_name=""Unknown""","http_refer=""https://mysite/dashboard/new/datalist.aspx?

i want just show the result before http_retcode, the result should be

(http_agent=""Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:62.0) Gecko/20100101 Firefox/62.0)

can you tell me how can i do that?

[kamlesh_vaghela]

@khanlarloo

try this:

YOUR_SEARCH  | rex field=_raw "\"(?<A>http_agent=.*)\"\"\",http_retcode"

Sample Search:

| makeresults | eval _raw="\"http_host=\"\"nts.mapnanyp.com\"\"\",\"http_agent=\"\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:62.0) Gecko/20100101 Firefox/62.0\"\"\",http_retcode=200,\"msg=\"\"HTTP get request from,content_switch_name=\"none\",server_pool_name=\"NTS\",\"user_name=\"\"Unknown\"\"\",\"http_refer=\"\"https://mysite/dashboard/new/datalist.aspx?" | rex field=_raw "\"(?<A>http_agent=.*)\"\"\",http_retcode"

[khanlarloo]

it doesn't work.

[kamlesh_vaghela]

does it return blank or unexpected output?

[ddrillic]

Looks most cheerful to me ; -)

[kamlesh_vaghela]

Are you looking for round brackets ()?
Then just append it... 🙂

eval A="(".A.")";