# coding=utf8
# the above tag defines encoding for this document and is for Python 2.x compatibility
import re
regex = r"(?:^(?:[^|]*\|){7}\s)?([^=]+)=((?:\\\\=|[^=])+)(?:\s|$)"
test_str = ("eventId=621 externalId=7B48F50417A7455B9A2C1596B3C35AD3 start=1396040742441 end=1396040742443 catdt=Network-based IDS/IPS art=1396041080694 deviceSeverity=10 rt=1396041064361 dhost=ILOD-7VWN4M1 dst=10.20.103.36 destinationZoneURI=/All Zones/ArcSight System/Private Address Space Zones/RFC1918: 10.0.0.0-10.255.255.255 duser=Sim809 dproc=C:/Program Files (x86)/Microsoft Office/Office14/WINWORD.EXE filePath=E:/PARA 304 Pre-Trial Litigation/~WRD2772.tmp fsize=0 cs1=Log files written to USB drives | Log writing to USB drives flexString1=Site PRDMWWVSEPCON01 flexString2=Behavior cs1Label=Rule Name flexString1Label=Sep Site flexString2Label=Table ahost=prdjcapauacol02.associateaux.local agt=10.127.161.121 agentZoneURI=/All Zones/ArcSight System/Private Address Space Zones/RFC1918: 10.0.0.0-10.255.255.255 av=6.0.6.6865.0 atz=America/New_York aid=3gE+HCkUBABDhUsTXWORqkQ\\\\=\\\\= at=flexmulti_db dtz=America/New_York _cefVer=0.1 ad.USN.l=24433421 ad.GROUP__ID.c=D25FA45B0A6C6585003891A1914F817E ad.ACTION__TYPE.i=0 ad.SEND__SNMP__TRAP.i=0 ad.SITE__ID.c=2E3D68EF0A75961000FEAE1DA37518DA ad.EVENT__TIME.l=1396040806566 ad.ALERT.l=0 ad.PARAM__DEVICE__ID=USBSTOR\\\\\\\\Disk&Ven_Generic&Prod_Flash_Disk&Rev_8.07\\\\\\\\D6CC8E8A&0 ad.HARDWARE__KEY.c=E0B36DF9F91D7648753022D74006E1D1 ad.SERVER__ID.c=480FA3CE0A759610009ADF490BB8CBF3 ad.COMPUTER__ID.c=A7F4EE620A86644B00793AD899D78878 ad.CALLER__PROCESS__ID.l=28612 ad.AGENT__ID.c=7FF540280A86644B00793AD85F2B4CAB ad.ACTION.l=3 ad.DOMAIN__ID.c=C03FE8790A86644B00BA689B2F82C09B ad.VAPI__NAME=File Write\n")
matches = re.finditer(regex, test_str)
for matchNum, match in enumerate(matches, start=1):
print ("Match {matchNum} was found at {start}-{end}: {match}".format(matchNum = matchNum, start = match.start(), end = match.end(), match = match.group()))
for groupNum in range(0, len(match.groups())):
groupNum = groupNum + 1
print ("Group {groupNum} found at {start}-{end}: {group}".format(groupNum = groupNum, start = match.start(groupNum), end = match.end(groupNum), group = match.group(groupNum)))
# Note: for Python 2.7 compatibility, use ur"" to prefix the regex and u"" to prefix the test string and substitution.
Please keep in mind that these code samples are automatically generated and are not guaranteed to work. If you find any syntax errors, feel free to submit a bug report. For a full regex reference for Python, please visit: https://docs.python.org/3/library/re.html