regex101: PCRE (Legacy) Match Workspace

1st Alternative^(?:[^\s]+\s*:*){5}

^start of line

Non-Capturing Group(?:[^\s]+\s*:*){5}

{5}repeats the group contents below exactly 5 times:

Negated Character Class[^\s]+

+matches at least one character outside the set below:

\sany whitespace character

\s*any whitespace character, repeated any number of times

:*the literal : (58₁₀ / 72₈ / 3A₁₆) , repeated any number of times

2nd Alternative([^:]+):\s*([^,]+)[,$]*

Group 1([^:]+)

Negated Character Class[^:]+

+matches at least one character outside the set below:

:the literal : (58₁₀ / 72₈ / 3A₁₆)

\s*any whitespace character, repeated any number of times

Group 2([^,]+)

Negated Character Class[^,]+

+matches at least one character outside the set below:

,the literal , (44₁₀ / 54₈ / 2C₁₆)

Character Class[,$]*

*matches any number of characters from the set below:

,the literal , (44₁₀ / 54₈ / 2C₁₆)

$the literal $ (36₁₀ / 44₈ / 24₁₆)

Global pattern flags

g modifier: global. Finds all matches instead of stopping after the first

m modifier: multiline. Causes ^ and $ to match the start and end of each line, not only the start and end of the string

Search reference

Regular Expression

^(?:[^\s]+\s*:*){5}|([^:]+):\s*([^,]+)[,$]*

New

Aug 27 10:05:58 ciscoasa SFIMS: Protocol: TCP, SrcIP: 1.2.3.1, OriginalClientIP: ::, DstIP: 11.22.33.44, SrcPort: 50981, DstPort: 443, TCPFlags: 0x0, IngressZone: N_inside, EgressZone: N_outside, DE: Primary Detection Engine (ccc24074-6d7e-11e7-9213-b429232f86cc), Policy:allowed_new, ConnectType: Start, AccessControlRuleName: Allow port 80 443, AccessControlRuleAction: Allow, Prefilter Policy: WE_Prefilter, UserName: No Authentication Required, Client: SSL client, ApplicationProtocol: HTTPS, WebApplication: Windows, InitiatorPackets: 3, ResponderPackets: 1, InitiatorBytes: 436, ResponderBytes: 66, Policy: Balanced Security and Connectivity, DNSResponseType: No Error, Sinkhole: Unknown, URLCategory: Business and Economy, URLReputation: Well known, URL: splunk.com