topic Re: Regex question/request in Reporting

Regex question/request

Mike6960 — Fri, 20 Sep 2019 13:13:27 GMT

Is it possible to use regex to extract values in events that always end with .PDF ? I have got a chain of events, somewhere in this process a PDF doucment is generated, So the name of the PDF is not in all the events.

Re: Regex question/request

richgalloway — Fri, 20 Sep 2019 13:49:33 GMT

Please share some sample data and what you want extracted from it.

Re: Regex question/request

somesoni2 — Fri, 20 Sep 2019 13:52:16 GMT

YOu should be able to use following regex (assuming that youru PDF file name contains alphanueric characters only)

your base search | rex "(?<PDFFileName>[A-z0-9_]+\.(pdf|PDF))"

Again, for better solution, please provide sample data and highlight the portion you want to extract.

Re: Regex question/request

jpolvino — Fri, 20 Sep 2019 17:17:39 GMT

Sounds like you're saying that you're looking for all events related to one that eventually generates a PDF? If so then is there a unique identifier that ties them all together? I'm asking because you could use a subsearch to gather all unique identifiers from those "PDF" events, and then use those identifiers later in your search to find relates events.

Posting a sample list of events will help.

Re: Regex question/request

Mike6960 — Wed, 30 Sep 2020 02:26:54 GMT

this is a fragment of the events:

: Get file ABC_6_2019-09-30_VK-161.2285507.pdf from /opt/mulesoft/

I would like to extract the values: ABC_6_2019-09-30_VK-161.2285507.pdf
It always ends with .PDF but the first part can differ, in my example it starts with ABC but this can also be ZZ for example

Re: Regex question/request

Mike6960 — Wed, 30 Sep 2020 02:26:56 GMT

Thanks, almost what I need, due to the lack of me supplying an example not quite everything I need.

this is a fragment of the events:

: Get file ABC_6_2019-09-30_VK-161.2285507.pdf from /opt/mulesoft/

I would like to extract the values: ABC_6_2019-09-30_VK-161.2285507.pdf
It always ends with .PDF but the first part can differ, in my example it starts with ABC but this can also be ZZ for example

Re: Regex question/request

dmarling — Mon, 30 Sep 2019 16:01:02 GMT

Based on the example you provided in the question comments, this should return the data you are looking for:

| rex "(?<PDFFileName>\S+)\.[Pp][Dd][Ff]"

Here's the regex101 link showing it function on your example: https://regex101.com/r/OyLl8z/1