Hi.

I'm having the following problem. Some hosts in my logs come in format DOMAIN\SERVER and some server.domain_1part.domain_2part (delimeted once by \ or server times by . (dot)).

I need to extract:

1) domain name: so it would be DOMAIN from the first example or .domain_1part.domain_2part from the second one

2) server name: SERVER from both examples

 I've been trying to do this with just 1 regex but been failing continuosly;/

Any ideas or it's just simply impossible.

Hello zinkar,

The challenge here I think is that you want 1 regex to do it because matching individualy isnt that hard

This is a way to do it :

(.+)\\(.+)|^(.+?)\.(.+)

Notice the pipe symbol | which represents alternation

group 2 & 3 contain the server
group 1 & 4 contain the domain

If 2 is not empty than it will contain the server, otherwiser it's 3.
Same logic for the domain.

Let me know if this helps

Regards, Tom Pester

Just remembered. If you are using .NET you can use this nice feature:

Multiple Groups with The Same Name

The .NET framework allows multiple groups in the regular expression to have the same name. If you do so, both groups will store their matches in the same Group object. You won't be able to distinguish which group captured the text. This can be useful in regular expressions with multiple alternatives to match the same thing. E.g. if you want to match "a" followed by a digit 0..5, or "b" followed by a digit 4..7, and you only care about the digit, you could use the regex a(?'digit'[0-5])|b(?'digit'[4-7]). The group named "digit" will then give you the digit 0..7 that was matched, regardless of the letter.

 HTH, Tom Pester