splunk正则表达式消除最终报价

Question

我有：

Row 114005: Requester Name: "RETAIL\S2343W01$" Issued Common Name: "S2343W01.retail.fakename.com" User Principal Name: "S2343W01.retail.fakename.com" Serial Number: "4c22be0100010002d317" Certificate Template: Client Authentication - Retail Desktops Certificate Effective Date: 12/1/2011 10:38 AM Certificate Expiration Date: 11/30/2012 10:38 AMMaximum Row Index: 114005

我有正则表达式：

(?i)Serial Number: “(?P<cert_SN>.+?\n)

结果如下：

cert_SN = 4c22be0100010002d317"

如何消除最终报价？

Answer 1

您可以.+?\n

替换[^"]+

[^"]是一个不包含双引号的字符类。

Answer 2

尝试：

(?i)Serial Number:\s\"(?P<cert_sn>\w+)

或者如果需要捕获空字段：

(?i)Serial Number:\s\"(?P<cert_sn>[^\"]*)\"