using System;
using System.Text.RegularExpressions;
public class Example
{
public static void Main()
{
string pattern = @"(?:^(?:[^|]*\|){7}\s)?([^=]+)=((?:\\\\=|[^=])+)(?:\s|$)";
string input = @"eventId=621 externalId=7B48F50417A7455B9A2C1596B3C35AD3 start=1396040742441 end=1396040742443 catdt=Network-based IDS/IPS art=1396041080694 deviceSeverity=10 rt=1396041064361 dhost=ILOD-7VWN4M1 dst=10.20.103.36 destinationZoneURI=/All Zones/ArcSight System/Private Address Space Zones/RFC1918: 10.0.0.0-10.255.255.255 duser=Sim809 dproc=C:/Program Files (x86)/Microsoft Office/Office14/WINWORD.EXE filePath=E:/PARA 304 Pre-Trial Litigation/~WRD2772.tmp fsize=0 cs1=Log files written to USB drives | Log writing to USB drives flexString1=Site PRDMWWVSEPCON01 flexString2=Behavior cs1Label=Rule Name flexString1Label=Sep Site flexString2Label=Table ahost=prdjcapauacol02.associateaux.local agt=10.127.161.121 agentZoneURI=/All Zones/ArcSight System/Private Address Space Zones/RFC1918: 10.0.0.0-10.255.255.255 av=6.0.6.6865.0 atz=America/New_York aid=3gE+HCkUBABDhUsTXWORqkQ\\=\\= at=flexmulti_db dtz=America/New_York _cefVer=0.1 ad.USN.l=24433421 ad.GROUP__ID.c=D25FA45B0A6C6585003891A1914F817E ad.ACTION__TYPE.i=0 ad.SEND__SNMP__TRAP.i=0 ad.SITE__ID.c=2E3D68EF0A75961000FEAE1DA37518DA ad.EVENT__TIME.l=1396040806566 ad.ALERT.l=0 ad.PARAM__DEVICE__ID=USBSTOR\\\\Disk&Ven_Generic&Prod_Flash_Disk&Rev_8.07\\\\D6CC8E8A&0 ad.HARDWARE__KEY.c=E0B36DF9F91D7648753022D74006E1D1 ad.SERVER__ID.c=480FA3CE0A759610009ADF490BB8CBF3 ad.COMPUTER__ID.c=A7F4EE620A86644B00793AD899D78878 ad.CALLER__PROCESS__ID.l=28612 ad.AGENT__ID.c=7FF540280A86644B00793AD85F2B4CAB ad.ACTION.l=3 ad.DOMAIN__ID.c=C03FE8790A86644B00BA689B2F82C09B ad.VAPI__NAME=File Write
";
foreach (Match m in Regex.Matches(input, pattern))
{
Console.WriteLine("'{0}' found at index {1}.", m.Value, m.Index);
}
}
}
Please keep in mind that these code samples are automatically generated and are not guaranteed to work. If you find any syntax errors, feel free to submit a bug report. For a full regex reference for C#, please visit: https://msdn.microsoft.com/en-us/library/system.text.regularexpressions.regex(v=vs.110).aspx