Regex Help

[theouhuios]

Hello

I need some help in fixing the regex for the below events. it works on few and it doesn't on few.

The first event has two lines. Second has a single line event and third is also a single line event with multiple Ip's

**Intel(R) PRO/1000 MT Network Connection** NY12434ABC {"**10.1.1.3**"} 00:12:34:56:78:90 
**Intel(R) PRO/1000 MT Network Connection #2** NY12434ABC {"**10.4.5.6**"} 00:12:34:56:78:90 

**Intel(R) PRO/1000 MT Network Connection #2** NYAB1234ABC {"**10.1.2.3**"} 00:12:34:56:78:90

**broadway Connection #2** NY1234ABC {"**10.1.1.3**", "**100.66.65.7**","**180.69.65.98**"} 00:12:34:56:78:90

So the regex which I am using is below. It matches for the first line in first event and the second event. So it has to be made repetitive which I am not able to get my mind through even though I have done it few times before. In the third event I want all the three IP's under the field IP_address and I am not sure on how to do it.

(?P<Description>.*)\s+[A-Za-z0-9]{3}\S+\s+\{\"(?P<IP_address>[^\"]+)?\"\}\s+(?P<MAC>\S+)

PS: Please ignore the * . That's just to give the community an idea on what are the field values which need to be extracted.

Thanks
theou

[somesoni2]

Try this

..your base search...| rex max_match=0 "(?P<Description>.*)\s+[A-Za-z0-9]{3}\S+\s+\{[\"\*\.\d,\s]+\}\s+(?P<MAC>\S+)"
| rex max_match=0 "\"\*\*(?<IP_address>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})\*\*\"" 

[MuS]

Hi theouhuios,

did you try your regex with the argument max_match=0?

max_match controls the number of times the regex is matched. If greater than 1, the resulting fields will be multivalued fields. Defaults to 1, use 0 to mean unlimited.

hope this helps ...

cheers, MuS

[theouhuios]

Yes I did try that. it works for the first event , but not or the third one. I am looking for a regex which can match on all three conditions if possible