Specific rex doesnt seem to work

[clintla]

Have 3 sets of drives that are listed differently by different systems.

FC SSD

SATAII SSD

Fibre Channel

SATAII

Really its just SATA, Fibre Channel & SSD & I'd like to group them as such.

I've tried many variations of

"Drive\sType:\s+(?<drive_tier>Fibre|SATAII\\s\\s|/SSD/)"

The above SHOULD work IMO. but it only lists the first 2. I've tried many
variations & either it finds the first 2 or lists all 4.

If I take out the \s\s on the plain SATA then it will group the SATA SSD's
with it- its not what I want but its the only grouping I've been able to
see with this. The 2 SATAII's seem to make this a little more difficult.

Anyone have any suggestions to try?

[Paolo_Prigione · Accepted solution]

Here you go:

"Drive Type: (?:SATAII |FC )*(?<drive_tier>Fibre|SATAII(?! SSD)|SSD)"

Results:

• Drive Type: SATAII SSD --> SSD
• Drive Type: SATAII --> SATAII
• Drive Type: Fibre Channel --> Fibre
• Drive Type: FC SSD --> SSD

There's no way to have it output an uppercase "FIBRE" as regexes only output what was in the original text.

[malberto]

1. Why are you doing "\s" in one place and "\s" in another!

2. Why do you have "SATAII\s\s" when sometimes you have "SATAII" and sometimes "SATA SSD". Your regex will match either. You want: "...|SATAII|..."

3. It seems to be that what you REALLY want is just:

   "Drive\sType:\s+(?.+?)$"

Any DriveType until the newline.

[clintla]

SATAII & SATAII SSD are separate. I want those 2
Fibre SSD & SATAII SSD's to be grouped togather.

When I put in the \s\s it separated SATAII vs. SATA SSD.

I thought if I had |SSD that it would pickup anything
that had SSD in the string.. seems like a nice idea- but
it doesnt work

[clintla]

Drive Type: FC SSD

Drive Type: Fibre Channel

Drive Type: SATAII

Drive Type: SATAII SSD

Above is exacltly the way they appear.
I'd like to just have 3 groups.

SATAII

SSD (the 2 SSD's combined)

FIBRE

[jbsplunk]

could you post an example of some events that you'd like to apply the rex to so we can get an idea of the format for the events?