How to write regex to extract a string, but ignore the last portion if a certain string is present?

[Smith_Splunk]

Hi All,

Below are the two different events we have,

1) DateTime="2014-11-04 06:42:35" SourceFile=ABCD.EFGH.IJKL.ABCTFILE DestFile=XYZA.R160001B.WERT10.A0005.H0001B00
2) DateTime="2014-11-04 06:41:35" SourceFile=XYZA.ER5678A.WERT10.T0005.J0001B00 DestFile=XYZA.R160001B.WERT10.A0005.H0001B00

We need to extract the string which is highlighted in BOLD from SourceFile. The rule is to ignore the complete word where "BOO" is present in end of the string(In 2nd event "J0001B00") or extract complete string if "BOO" is not present (in 1st Event)

We wrote a regEx which will match ---> (?i)SourceFile\W(.?).\w+\s
**ABCD.EFGH.IJKL* from 1st event ==> here "ABCTFILE" is missing
XYZA.ER5678A.WERT10.T0005 from 2nd event

We have issues in extracting from 1st event.

Online RegEx Editor with above Events
http://rubular.com/r/O6tB73XSpz
Can any one please help to write proper regEx which will extract both string

Thanks,
Smith

[gfuente · Accepted solution]

Hello

Try with this regex:

SourceFile\=(?<yourfield>(\w+|\.){7})(\sDestFile|\.\w*B00\s)

Regards

[davebrooking]

If the format of the filename is not a fixed number of period separated names, you could use something like

SourceFile\=(?P<yourfield>(\w+|\.)+?)(|\.\w*B00)\sDestFile\=