Regular Expressions 101

Community Patterns

22

Get path from any text

Created·2023-01-31 14:38
Updated·2023-07-23 20:17
Flavor·PCRE2 (PHP)
Recommended·
Get path (windows style) from any type of text (error message, e-mail corps ...), quoted or not. THIS IS THE SINGLE LINE VERSION ! If you want understand how it work or edit it, go https://regex101.com/r/7o2fyy Relative path are not supported The goal is to catch what "Look like" a path. See the limitations UNC path and prefix path like //./], [//?/] or [//./UNC/] are allowed some url path like [file:///C:/] or [file://] are allowed Catch path quoted with ["] and [']. But these quotes are include with the catch Quoted path is not concerned by limitations Limitations : (only unquoted path) [dot] and [space] is allowed, but not in a row [dot+space] or [space+dot at end of file name isn't catched INSIDE A NAME FILE (or last directory if it is a path to a directory) : [comma] is not supported (it stop the catch) after a first [dot], any [space] stop the catch after a [space], catch is stoped if next character is not a [letter], [digit] or [-] so, double [space] stop the catch Compatibility compatible PCRE, PCRE2 AutoHotkey : don't forget to escape "%" in "`%" /!\ Powershell and .Net /!\\ : this regex need some modification to be interpreted by powershell. You have to replace each (?&CapturGroupName) by \k. Use this powershell code to do this replacement : ` $powershellRegex = @' [Put here the regex to replace (?&CapturGroupName) with \k] '@ -replace '\(\?&(\w+)\)', '\k' ` This example code must return : [Put here the regex to replace \k with \k]
Submitted by nitrateag

Community Library Entry

0

Regular Expression
Created·2017-09-07 07:01
Flavor·PCRE (Legacy)

/
(?P<event_message>An account was successfully logged on.)\s+Subject:\s+Security ID:\s+(?P<subject_security_id>.*?)\s+Account Name:\s+(?P<subject_account_name>.*?)\s+Account Domain:\s+(?P<subject_account_domain>.*?)\s+Logon ID:\s+(?P<subject_logon_id>.*?)\s+Logon Type:\s+(?P<logon_type>.*?)\s+(?:Impersonation Level:\s+(?P<impersonation_level>.*?)\s+)?New Logon:\s+Security ID:\s+(?P<security_id>.*?)\s+Account Name:\s+(?P<logon_account_name>.*?)\s+Account Domain:\s*(?P<logon_account_domain>.*?)\s+Logon ID:\s+(?P<session_id>.*?)\s+Logon GUID:\s+(?P<logon_guid>.*?)\s+Process Information:\s+Process ID:\s+(?P<process_id>.*?)\s+Process Name:\s+(?P<process_name>.*?)\s+Network Information:\s+Workstation Name:\s+(?P<workstation_name>.*?)\s*Source Network Address:\s+(?P<src_addr>\S+)\s+Source Port:\s+(?P<src_port>.*?)\s+Detailed Authentication Information:\s+Logon Process:\s+(?P<logon_process>.*?)\s+Authentication Package:\s+(?P<auth_package>\S+)\s+Transited Services:\s+(?P<trans_serv>.*?)\s+Package Name \S+\s+\S+\s+(?P<package_name>.*?)\s+Key Length:\s+(?P<key_length>.*?)\s+(?P<event_details>.*)
/
g
Open regex in editor

Description

An account was successfully logged on

Submitted by anonymous