Note that there are some explanatory texts on larger screens.

plurals
  1. PO
    text
    copied!<h2>Pure bash solution:</h2> <pre><code>data='discover-repository-location=null, File Name=null, date-detected=Tue Jun11 12:44:14 UTC 2013, endpoint-machine-name=null, incident-id=545527, sender-ip=12.1.141.87, sender-email=WinNT://tmpdm/tmpcmp, Assigned To=null, sender-port=-null, endpoint-domain-name=null, Business Unit=null, endpoint-dos-volume-name=null, file-access-date=null, date-sent=Tue Jun 11 12:44:14 UTC 2013, endpoint-file-name=null, file-modified-by=null, Country=null, Manager Email=null, plugin-chain-id=1, discover-server=null, data-owner-name=null, Dismissal Reason=null, Last Name=null, First Name=null, Phone=null, subject=HTTP incident, Sender Email=null, UserID=null, endpoint-user-name=null, endpoint-volume-name=null, discover-name=null, discover-content-root-path=null, data-owner-email=null, file-create-date=null, endpoint-application-name=null, Employee Code=null, Region=null, Manager First Name=null, path=null, endpoint-application-path=null, Manager Last Name=null, Department=null, discover-location=null, protocol=HTTP, Resolution=null, file-owner=null, Postal Code=null, endpoint-file-path=null, Title=null, discover-extraction-date=null, Script-attribute=null, Manager Phone=null, file-created-by=null, file-owner-domain=nul' declare -A allValues while read -s -d ',' line; do IFS='=' read key value &lt;&lt;&lt; "${line}" allValues["$key"]=$value done &lt;&lt;&lt; "$data," echo "${allValues['protocol']}" # prints HTTP echo "${allValues['sender-email']}" # prints WinNT://tmpdm/tmpcmp </code></pre> <p>This way you can get any field you want. Of course it will freak out if you have <code>,</code> or <code>=</code> characters inside variables.</p>
 

Querying!

 
Guidance

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload