double whitespace as terminator in "findstr"

Sorry the third line was meant to say:

Eg. To extract 1wr2s34d5h6 from: "...Header1 1wr2s34d5h6 Header2 789 :10 Header3..."

[findstr $variable "Header1 " 8 "  "]

Hi Kevin

Thanks for the suggestion it looks like that doesn't seem to catch it either.

[root@ve11a:Active:Changes Pending] config  tmsh list ltm rule myrule
ltm rule myrule {
    when RULE_INIT {
  set test "Header1 1wr2s34d5h6  Header2 789 :10 Header3"
  log local0. $test
  log local0. "\[findstr $test Header1 8 \"  \"\] [findstr $test Header1 8 "  "]"
}
}

[root@ve11a:Active:Changes Pending] config  tail -f /var/log/ltm
Jul 16 04:56:02 ve11a info tmm1[8160]: Rule /Common/myrule : Header1 1wr2s34d5h6  Header2 789 :10 Header3
Jul 16 04:56:02 ve11a info tmm1[8160]: Rule /Common/myrule : [findstr Header1 1wr2s34d5h6  Header2 789 :10 Header3 Header1 8 "  "] 1wr2s34d5h6

Thanks nitass. I get the same result when I run your rule however when I substitute my actual headers it does seem to work.

The one that is failing is doing the findstr on an SSL::payload. I tried setting a variable as the SSL::payload and then running the findstr on that with no luck.

Strangely enough if I set a variable as the actual payload text it works.

I tried "\r\n" and it work perfectly. Thanks Kevin, this one was really bugging me.