I am working two extract fields and I have the following two lines:
"ActionName processing for AccountName completed"
"ActionName processing for account: AccountName completed"
I want to extract ActionName and AccountName as new fields using the field extractor. I am writing the expression myself and was doing something like the following:
"(?<ActionName>\w+) processing for (?<AccountName>\w+) completed"
In doing this though, I am missing the second event, "ActionName processing for account: AccountName completed". Is there a way I can have my expression run for both events correctly? I want to run with an unknown amount of space between the two and wanted to avoid doing two extractions.
I am writing the expression myself since the other way does not work correctly either.
This should do it:
"(?<ActionName>\w+) processing for (account:\s)?(?<AccountName>\w+) completed"
The (account:\s)?
portion means that the string "account: " can appear 0 or 1 times (or in plain English, that it's optional).
Hope this helps.
This should do it:
"(?<ActionName>\w+) processing for (account:\s)?(?<AccountName>\w+) completed"
The (account:\s)?
portion means that the string "account: " can appear 0 or 1 times (or in plain English, that it's optional).
Hope this helps.
This is exactly what I was looking for. Thank you!