Forum Discussion
koheed_51878
Nimbostratus
Nimbostratusdouble whitespace as terminator in "findstr"
Hi All(long time lurker, first time poster)
Sorry if this has been addressed but is there a way to use two whitespaces as the terminator in a findstr.
Eg. To extract 123456 from: ".....
koheed_51878Nimbostratus
NimbostratusThanks nitass. I get the same result when I run your rule however when I substitute my actual headers it does seem to work.
The one that is failing is doing the findstr on an SSL::payload. I tried setting a variable as the SSL::payload and then running the findstr on that with no luck.
Strangely enough if I set a variable as the actual payload text it works.
