Please help with REGEX problem.
Sample Data:
Bank summary of John_Doe2/default (0.03 seconds): deposit (15 dollars, 0 cents), withdrawal (2 dollars, 0 cents).
This is the regex I use to extract the numbers. It works.
| rex "\sdeposit \((?<Deposit>\d+)" | rex "\s*withdrawal \((?<Withdrawal>\d+)" | table Deposit Withdrawal | addcoltotals
Now I want to include "Names" in my search and put them in one table along with the rest of the numbers. I tried the REGEX below, but I keep getting blanks in the "Name" column. What am I missing here?
| rex "\sof \((?<Name>\([A-Za-z0-9_])" | rex "\sdeposit \((?<Deposit>\d+)" | rex "\s*withdrawal \((?<Withdrawal>\d+)" | table Name Deposit Withdrawal | addcoltotals
Try this:
| rex "\sof (?<Name>[A-Za-z0-9_]+)" | rex "\sdeposit \((?<Deposit>\d+)" | rex "\s*withdrawal \((?<Withdrawal>\d+)" | table Name Deposit Withdrawal | addcoltotals
There were some extra opening parentheses, and no + quantifier.
Note, if you can control that output it's easier to change it to key=value pairs - then you don't need to mess around with regular expressions for field extraction.
Try this:
| rex "\sof (?<Name>[A-Za-z0-9_]+)" | rex "\sdeposit \((?<Deposit>\d+)" | rex "\s*withdrawal \((?<Withdrawal>\d+)" | table Name Deposit Withdrawal | addcoltotals
There were some extra opening parentheses, and no + quantifier.
Note, if you can control that output it's easier to change it to key=value pairs - then you don't need to mess around with regular expressions for field extraction.
I posted a new question titled "Regex Money" so feel free to look it up and post your response.
Here's my new question:
If John took money out three times within a 24-hour period, using the REGEX below, I would have a 3-line output.
| rex "\sof (?
But all I need is a one-liner like this:
John (Deposit: 0) (Withdrawal: 110) (Total Withdrawal: 110)
I tried multiple combinations but keep coming up emp
Great. Don't forget to mark this as solved.
It's the little things. Thanks! It works!