splunk regex eliminate final quote

Question

I have:

Row 114005: Requester Name: "RETAIL\S2343W01$" Issued Common Name: "S2343W01.retail.fakename.com" User Principal Name: "S2343W01.retail.fakename.com" Serial Number: "4c22be0100010002d317" Certificate Template: Client Authentication - Retail Desktops Certificate Effective Date: 12/1/2011 10:38 AM Certificate Expiration Date: 11/30/2012 10:38 AMMaximum Row Index: 114005

And I have regex:

(?i)Serial Number: “(?P<cert_SN>.+?\n)

Result is like:

cert_SN = 4c22be0100010002d317"

How can I eliminate the final quote?

Answer 1

Try:

(?i)Serial Number:\s\"(?P<cert_sn>\w+)

Or if need to capture empty fields:

(?i)Serial Number:\s\"(?P<cert_sn>[^\"]*)\"

Answer 2

you can replace .+?\n by [^"]+

[^"] is a character class that doesn't contain the double quote.