regex to fetch a particular field available in different places in different events

[dtccsundar]

I have a field( version) which is available in different position in different events of same sourcetype,Since the prior field(description) to this has irregular count of characters .Due to this is am seeing null values wherever the field(version) in different positions.

I would want fetch the field(version) wherever the field is available in the events of sourcetype.I tried the below ,

| rex field=_raw "Version=(?<Version>\"\w+\s+\w+\".*?)," | rex mode=sed field=Version "s/\\\"//g"

but it didn't worked .Please suggest me a way to fetch this .

[ITWhisperer]

It looks like the rex should work except when the field is not followed by a comma.

Can you provide some sample events of both working and not working cases?

[dtccsundar]

Please let me know if you require more info on this .

[dtccsundar]

It works here,Actually it gives data normally without regex

11/23/21 2:12:05.169 AM 2021-11-23 02:12:05.169, Name="LS4J4XMV2", DN="LS4J4XMV2.corp.mtnn.com", Factor="Laptop", Tag="121907", Company="MTNN", Status="Installed",Group="End User Support", Location="WFH", OS="Windows 10 Enterprise", Last_Discovered_On="2021-11-19 12:43:56", IP_Address="172.29.120.28", Number="4J4XMV2", Class="Computer", Domain="global", IT_Status="Active", Discoverable="true", sysid="0045134fdb75f34829a475fb8c961929", Assigned_To="Sandro", Comments="2021-02-23: 'In Transit' - Device is defective and being returned to office by user.", Version="32.35.0", F_IP_Address="192.168.0.251", F_Agent_ID="oz2cqkQi7eddOhEwvZX", F_Last_Audit="2021-11-18 02:27:47.0000000", Polled_On="2021-11-18 02:27:42.0000000", Reporting_Status="Reporting", _Match_Type="FQDN", _Match_ITAM="LS4J4XMV2", _Match_Tool="LS4J4XMV2", _IngestionID="F1685D71-751B-461A-8146-EBF51C71BEF5"

This not gives actual version after using regex too .It gives blank after filling null 

11/23/21 2:12:04.916 AM 2021-11-23 02:12:04.916, Name="LS8N4YPQ2", DN="LS8N4YPQ2.corp.mtnn.com", Factor="Laptop", Tag="148237", Status="Installed", Group="End User Support", Location="MNP01-108", OS="Windows 10 Enterprise", Last_Discovered_On="2021-11-19 07:51:29", IP_Address="172.29.119.234", Number="8N4YPQ2", Class="Computer", Domain="global", IT_Status="Active", Discoverable="true", sysid="0007f529dbe0e3c49d109ee8db96194e", Assigned_To="Leonard", Description="2019-09-13 No recent discovery. LS8N4YPQ2 not in McAfee ePO. Setting status to "In Stock"", Version="32.35.0", F_IP_Address="192.168.24.11", F_Agent_ID="h7r8wz0zFCfdbvcu4xc", F_Last_Audit="2021-11-19 16:52:56.0000000", Polled_On="2021-11-19 17:22:54.0000000", Reporting_Status="Reporting", _Match_Type="FQDN", _Match_ITAM="LS8N4YPQ2", _Match_Tool="LS8N4YPQ2", _IngestionID="C4432752-1B32-4799-8204-3B966AB115B0"

[ITWhisperer]

Neither of these version strings would be picked up by your rex expression since they don't have spaces in.

Since you go on to remove the double quotes, why not not capture them in the first place?

| rex "Version=\"(?<Version>[^\"]+)\""