$re = '/(?:^(?:[^|]*\|){7}\s)?([^=]+)=((?:\\\\\\\\=|[^=])+)(?:\s|$)/';
$str = 'eventId=621 externalId=7B48F50417A7455B9A2C1596B3C35AD3 start=1396040742441 end=1396040742443 catdt=Network-based IDS/IPS art=1396041080694 deviceSeverity=10 rt=1396041064361 dhost=ILOD-7VWN4M1 dst=10.20.103.36 destinationZoneURI=/All Zones/ArcSight System/Private Address Space Zones/RFC1918: 10.0.0.0-10.255.255.255 duser=Sim809 dproc=C:/Program Files (x86)/Microsoft Office/Office14/WINWORD.EXE filePath=E:/PARA 304 Pre-Trial Litigation/~WRD2772.tmp fsize=0 cs1=Log files written to USB drives | Log writing to USB drives flexString1=Site PRDMWWVSEPCON01 flexString2=Behavior cs1Label=Rule Name flexString1Label=Sep Site flexString2Label=Table ahost=prdjcapauacol02.associateaux.local agt=10.127.161.121 agentZoneURI=/All Zones/ArcSight System/Private Address Space Zones/RFC1918: 10.0.0.0-10.255.255.255 av=6.0.6.6865.0 atz=America/New_York aid=3gE+HCkUBABDhUsTXWORqkQ\\\\=\\\\= at=flexmulti_db dtz=America/New_York _cefVer=0.1 ad.USN.l=24433421 ad.GROUP__ID.c=D25FA45B0A6C6585003891A1914F817E ad.ACTION__TYPE.i=0 ad.SEND__SNMP__TRAP.i=0 ad.SITE__ID.c=2E3D68EF0A75961000FEAE1DA37518DA ad.EVENT__TIME.l=1396040806566 ad.ALERT.l=0 ad.PARAM__DEVICE__ID=USBSTOR\\\\\\\\Disk&Ven_Generic&Prod_Flash_Disk&Rev_8.07\\\\\\\\D6CC8E8A&0 ad.HARDWARE__KEY.c=E0B36DF9F91D7648753022D74006E1D1 ad.SERVER__ID.c=480FA3CE0A759610009ADF490BB8CBF3 ad.COMPUTER__ID.c=A7F4EE620A86644B00793AD899D78878 ad.CALLER__PROCESS__ID.l=28612 ad.AGENT__ID.c=7FF540280A86644B00793AD85F2B4CAB ad.ACTION.l=3 ad.DOMAIN__ID.c=C03FE8790A86644B00BA689B2F82C09B ad.VAPI__NAME=File Write
';
preg_match_all($re, $str, $matches, PREG_SET_ORDER, 0);
// Print the entire match result
var_dump($matches);
Please keep in mind that these code samples are automatically generated and are not guaranteed to work. If you find any syntax errors, feel free to submit a bug report. For a full regex reference for PHP, please visit: http://php.net/manual/en/ref.pcre.php