Regex -or- How to cleanup field values

[mikefoti]

A single event looks like this:

Row 113711: Requester Name: "RETAIL\HH01-0002" User Principal Name: "[email protected]" Serial Number: "41444bca9b200010002d1f1" Certificate Template: "ClientAuth" Certificate Effective Date:
11/29/2011 10:10 AM Certificate Expiration Date: 11/28/2013 10:10 AM

The only way I found to extract fileds for the Expiration & Effective dates was custom regex that looks like this:

(?-s)(?i)(?PCertificate Effective Date:.+\n?)

(?-s)(?i)(?PCertificate Expiration Date:.+\n?)**

My problem is that the field values contain text in addition to the dates and time information, for example:

cert_EndDate=Certificate Expiration Date: 11/28/2013 10:36 AM

My question is, how can I get ride of the text within the field values?

[mikefoti]

Wow... that's not what I expected.

So if I understand correclty, only the portion between (P and the closing ) become the value of the field?

Is this corrcet?

[Ayn]

Yes. That is how regexes work.

[BobM · Accepted solution]

You just need to move the text out of the bracket but I would also lock down the date format.

(?-s)(?i)Certificate Effective Date: (?P<cert_startdate>[\d/]+ [\d:]+ [AP]M)

(?-s)(?i)Certificate Expiration Date: (?P<cert_enddate>[\d/]+ [\d:]+ [AP]M)