1
response

After using kvp parser i've got variables with spaces in names. For example: "$Event Time" or "$Source Name".

I'm interested in two things:
1. How i can interact with this variable names? For example i'm trying construction "$EventTime = $Event Time;" with many shield variations: ",',),], etc, but this not work.
2. it is possible to prevent this situation? Massage format example below:

"DeviceEvent: Virus found,IP Address: 10.X.X.X,Computer name: xxx-xxx,Source: Auto-Protect scan,Risk name: Infostealer.Gampass,Occurrences: 1,File path: X:\xxxx_xxx.exe,Description: ,Actual action: Moved back,Requested action: Quarantined,Secondary action: Deleted,Event time: 2020-01-21 17:24:58,Event Insert Time: 2020-01-21 17:27:06,End Time: 2020-01-21 17:59:17,Last update time: 2020-01-21 18:01:07,Domain Name: xxxx,Group Name: XXXX,Server Name: xx-xxx,User Name: SYSTEM,Source Computer Name: ,Source Computer IP: ,Disposition: Reputation was not used in this detection.........."

AskedJanuary 22, 2020 - 9:47pm

Answer (1)

${Event Time} should work, at least with the EE. Otherwise as a workaround you could also rename the field with rename_field("Event Time", "EventTime").