#include <StringConstants.au3> ; to declare the Constants of StringRegExp
#include <Array.au3> ; UDF needed for _ArrayDisplay and _ArrayConcatenate
Local $sRegex = "(?m)Subject:\n\s+Security ID:[^\n]+\n\s+Account Name:\s+(?<account_creator>[^\n]+)"
Local $sString = "6/6/19" & @CRLF & _
"9:27:22.000 AM " & @CRLF & _
"06/06/2019 09:27:22 AM" & @CRLF & _
"LogName=Security" & @CRLF & _
"SourceName=Microsoft Windows security auditing." & @CRLF & _
"EventCode=4720" & @CRLF & _
"EventType=0" & @CRLF & _
"Type=Information" & @CRLF & _
"ComputerName=CPMASNAAD03.na.cintas.com" & @CRLF & _
"TaskCategory=User Account Management" & @CRLF & _
"OpCode=Info" & @CRLF & _
"RecordNumber=5472484169" & @CRLF & _
"Keywords=Audit Success" & @CRLF & _
"Message=A user account was created." & @CRLF & _
"" & @CRLF & _
"Subject:" & @CRLF & _
" Security ID: "xxxxxxxxx"" & @CRLF & _
" Account Name: Account Creator" & @CRLF & _
" Account Domain: xxxxx" & @CRLF & _
" Logon ID: xxxxxxx" & @CRLF & _
"" & @CRLF & _
"New Account:" & @CRLF & _
" Security ID: "xxxxxx"" & @CRLF & _
" Account Name: Account Created" & @CRLF & _
" Account Domain: xxxxxxx" & @CRLF & _
"" & @CRLF & _
"Attributes:" & @CRLF & _
" SAM Account Name: xxxxxxxx" & @CRLF & _
" Display Name: User" & @CRLF & _
" User Principal Name: -" & @CRLF & _
" Home Directory: -" & @CRLF & _
" Home Drive: -" & @CRLF & _
" Script Path: -" & @CRLF & _
" Profile Path: -" & @CRLF & _
" User Workstations: -" & @CRLF & _
" Password Last Set: <never>" & @CRLF & _
" Account Expires: <never>" & @CRLF & _
" Primary Group ID: 513" & @CRLF & _
" Allowed To Delegate To: -" & @CRLF & _
" Old UAC Value: 0x0" & @CRLF & _
" New UAC Value: 0x11" & @CRLF & _
" User Account Control: " & @CRLF & _
" Account Disabled" & @CRLF & _
" 'Normal Account' - Enabled" & @CRLF & _
" User Parameters: -" & @CRLF & _
" SID History: -" & @CRLF & _
" Logon Hours: <value not set>" & @CRLF & _
"" & @CRLF & _
"Additional Information:" & @CRLF & _
" Privileges"
Local $aArray = StringRegExp($sString, $sRegex, $STR_REGEXPARRAYGLOBALFULLMATCH)
Local $aFullArray[0]
For $i = 0 To UBound($aArray) -1
_ArrayConcatenate($aFullArray, $aArray[$i])
Next
$aArray = $aFullArray
; Present the entire match result
_ArrayDisplay($aArray, "Result")
Please keep in mind that these code samples are automatically generated and are not guaranteed to work. If you find any syntax errors, feel free to submit a bug report. For a full regex reference for AutoIt, please visit: https://www.autoitscript.com/autoit3/docs/functions/StringRegExp.htm