Regex: Help with breaking down a string

[andres91302]

Hello everyone,

Thank you for the help in advance.. I would like to break down a string of values into LETTERS and NUMBERS after the "_" character. For example if I the string NEXTTOWN_YU8392 I would want to get LETTERS= YU and NUMBERS equal to 8392 I have tried this code:

| makeresults 
| eval string="DOWN_X9"
| rex field=string "_(?<letters>[A-Z])(?<numbers>\d+)"

and it gives me:
letters=X
numbers=9

but when I try something like:

| makeresults 
| eval TEST = "DOWN_XX9 UP_xxx90 LEFT_tUIJ89" 
| makemv TEST 
| mvexpand TEST
| rex field=TEST "_(?<letters>[A-Z])(?<numbers>\d+)"

it returns nothing at all... I will be so thank you if you could help me out find my error please!
what I would like would be:

TEST	letters	numbers
DOWN_XX9	XX	9
UP_xxx90	XXX	90
LEFT_tUIJ89	tUIJ	89

thanks guys!

[ITWhisperer]

| makeresults 
| eval TEST = "DOWN_XX9 UP_xxx90 LEFT_tUIJ89" 
| makemv TEST 
| mvexpand TEST
| rex field=TEST "_(?<letters>[A-Za-z]+)(?<numbers>\d+)"

[andres91302]

@ITWhisperer so the "plus" sign was the only thing missing? I'm so sorry sir I will very much appreciate if you could explain to me why it was working with the first example my code but it didn't work for my second one?

[ITWhisperer · Accepted solution]

In your first example your string was DOWN_X9 i.e. only one letter between the underscore _ and the number 9, so it matched your regex. In the second example, all your strings had more than one letter and indeed some were even lower case, which meant they didn't match the regex so no field was extracted.