How do I skip words in a field extraction?

[aohls]

I am working two extract fields and I have the following two lines:

"ActionName processing for AccountName completed"
"ActionName processing for account: AccountName completed"

I want to extract ActionName and AccountName as new fields using the field extractor. I am writing the expression myself and was doing something like the following:

"(?<ActionName>\w+) processing for (?<AccountName>\w+) completed"

In doing this though, I am missing the second event, "ActionName processing for account: AccountName completed". Is there a way I can have my expression run for both events correctly? I want to run with an unknown amount of space between the two and wanted to avoid doing two extractions.

I am writing the expression myself since the other way does not work correctly either.

[aholzer · Accepted solution]

This should do it:

"(?<ActionName>\w+) processing for (account:\s)?(?<AccountName>\w+) completed"

The (account:\s)? portion means that the string "account: " can appear 0 or 1 times (or in plain English, that it's optional).

Hope this helps.

[aohls]

This is exactly what I was looking for. Thank you!