How to use Regex to find values between two strings

[hartfoml]

I have this event:

<f:Table><f:Row><f:Cell>IE Group Policy</f:Cell></f:Row><f:Row><f:Cell>HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\SecureProtocols</f:Cell></f:Row><f:Row><f:Cell>Windows SChannel</f:Cell></f:Row><f:Row><f:Cell>HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Client\Enabled</f:Cell></f:Row><f:Row><f:Cell>IE</f:Cell></f:Row><f:Row><f:Cell>HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SecureProtocols</f:Cell></f:Row><f:Row><f:Cell>KB3009008</f:Cell></f:Row></f:Table> 

and I have other events like this. I want to extract the information between the <f:Cell></f:Cell> in this event, there are several entries, but in most, there is only one entry. How can I get this to work in all cases?

Help With Regex Please

[sundareshr · Accepted solution]

Try this

... | rex max_match=0 "\<f\:Cell\>(?<cellvalue>[^\<]+)\<\/f\:Cell\>" | table cellvalue | mvexpand cellvalue | ...

[maheshkk444]

There is single events which contains multiple conversationid:"conv_abc" workgroup, conversations:"conv_xyz" workgroup. I have to find all values between conversationid and workgroup which are in single event. I had tries one Rex but it giving content between first conversationid and last workgroup string

[hartfoml]

Thanks this works great

[skoelpin]

Here ya go..

(?<=\<f\:Cell\>).*(?=\<\/f\:Cell\>)

If you're doing it at index time then it will look like this (?P<FieldName>(?<=\<f\:Cell\>).*(?=\<\/f\:Cell\>))

This uses a lookbehind to sink into and a lookahead to sink into <\f:Cell>