Multivalue Field extaction using Regular Expressions

[perrinj2]

I'm trying to extract fields from the following event data

[Scenario_summary]
Scenario Type=Manual Scenario
Goal Profile Name=Schedule 1
Mode=Scenario Scheduling
Scenario Duration=Start 27 Vusers: 1 every 00:00:15 (HH:MM:SS); Run for 00:30:00 (HH:MM:SS); Stop all Vusers simultaneously
Load Behavior=Initialize each Vuser just before it runs

[Scripts]
apache_on_5154=D:\LoadRunner Repo\LoadRunner\Loadrunner Scripts\apache_on_5154\apache_on_5154.usr
AjaxClickAndScript1=D:\LoadRunner Scripts\SPLUNK_SOLUTION_2\AjaxClickAndScript1\AjaxClickAndScript1.usr
AddNewCustomer=D:\CPE_Demo\AddNewCustomer\AddNewCustomer.usr

[Scripts_types]
apache_on_5154=Multi+QTWeb
AjaxClickAndScript1=WebAjax
AddNewCustomer=Multi+QTWeb

Specifically I want to extract the LoadRunner group names and protocols below the [Scripts_types] which can be 1 to n depending on the Scenerio.  In this example the script names would be

apache_on_5154
AjaxClickAndScript1
AddNewCustomer

I've tried a regular expression with a named group to extract the fields. eg

\[Scripts_types\]\n(?<Group1>.+)=.+
\[Scripts_types\]\n(?:.+)=.+\n(?<Group2>.+)=.+\n(?:.+)=.+
\[Scripts_types\]\n(?:.+)=.+\n(?:.+)=.+\n(?<Group3>.+)=.+

But that gives me 3 different named fields and does not cater for case where there are more of less of these lines in the event. 

If I use a repeating group like

\[Scripts_types\](\n(?<GroupName>.+)=.+)+

It only captures the last iteration ie "AddNewCustomer" 

Anyone know how to deal with this? 

[perrinj2]

Further to this  the following regex 

\[Scripts_types\](?<Scripts_types>(?:\n(?:.+)=.+)+)

will extract a single named group with value

apache_on_5154=Multi+QTWeb AjaxClickAndScript1=WebAjax AddNewCustomer=Multi+QTWeb

which I think is the only regex that makes sense in this situation.

So I'll look at how to extract the required fields from the field values. Any tips on this approach appreciated.

[ITWhisperer · Accepted solution]

Having got a single field, can you not run a further regex on that to get just the data you require?

[perrinj2]

@ITWhisperer  Thanks, that's what I thought might be the next step. I was hoping to do it in one pass but that doesn't seem possible. 

[perrinj2]

It's one event

[thambisetty]

is below only one event ? if yes, please don't format the event before sharing it in community especially the question is about regular expression, we can't give proper answer if the event is modified and shared here.

[Scenario_summary]
Scenario Type=Manual Scenario
Goal Profile Name=Schedule 1
Mode=Scenario Scheduling
Scenario Duration=Start 27 Vusers: 1 every 00:00:15 (HH:MM:SS); Run for 00:30:00 (HH:MM:SS); Stop all Vusers simultaneously
Load Behavior=Initialize each Vuser just before it runs

[Scripts]
apache_on_5154=D:\LoadRunner Repo\LoadRunner\Loadrunner Scripts\apache_on_5154\apache_on_5154.usr
AjaxClickAndScript1=D:\LoadRunner Scripts\SPLUNK_SOLUTION_2\AjaxClickAndScript1\AjaxClickAndScript1.usr
AddNewCustomer=D:\CPE_Demo\AddNewCustomer\AddNewCustomer.usr

[Scripts_types]
apache_on_5154=Multi+QTWeb
AjaxClickAndScript1=WebAjax
AddNewCustomer=Multi+QTWeb