Split String with Random Length using DOS/Batch - regex

Question

I have a log file I need to process and extract data from. Each line contains a string of an event log output. Unfortunately, the parts of the string is NOT uniformly formatted. Here are a few example lines:
"Some random length string. 0x8dda46 0x1 0x384 C:\Program Files (x86)\some\path\foo0.exe "
"Some random leeeength string. 0xa95ac2 0x8cc C:\Program Files (x86)\some\path\foo1.exe %%1936 0xcc0 "
"Some random leength string. 0xbcd668 0x330 C:\Program Files (x86)\some\path\foo2.exe %%1936 0xf38 "
"Some random leeeeeeeength string. 0xbcd668 0x1 0x330 C:\Program Files (x86)\some\path\foo2.exe "
"Some random leeength string. 0x352c44 0xfc0 C:\Program Files (x86)\some\path\foo3.exe %%1936 0x92c "
"Some random leeeeength string. 0xa95ac2 0x0 0x8cc C:\Program Files (x86)\some\path\foo1.exe "
"Some random leength string. 0x352c44 0x0 0xfc0 C:\Program Files (x86)\some\path\foo3.exe "
I need to extract the "foo.exe" file name without the full path and the HEX value just before the "C:\Progra..." (it's the process ID)
so I want the output be:
0x384 foo0.exe
0x8cc foo1.exe
0x330 foo2.exe
0x330 foo2.exe
0xfc0 foo3.exe
0x8cc foo1.exe
0xfc0 foo3.exe
I'm trying to achieve the goal with as less "hard coded" search/replace as possible since many parts of the string is not going to be the same content or same length. I tried to use FOR /F to split the string, but I have no way to locate the two columns as they are always changing. Only thing is constant is the "C:\Program Files (x86)" part. (Plus FOR has a 52 variable limit)
I have written some tricky batch files, but I'm starting to think I'm asking too much of DOS ;-)
Thanks in advance for any help!

Answer 1

#ECHO OFF
SETLOCAL
FOR /f "tokens=1*delims=." %%a IN (q28333414.txt) DO (
FOR /f "tokens=1*delims=:" %%c IN ("%%~b") DO CALL :process %%c&CALL :report "%%d
)
GOTO :EOF
:process
SET hexval=%~3
IF DEFINED hexval shift&GOTO process
SET "hexval=%~1"
SET "drive=%~2:"
GOTO :eof
:report
SET "line=%drive%%~1"
SET "line="%line:.exe=.exe"%"
FOR %%r IN (%line%) DO ECHO %hexval% %%~nxr&GOTO :eof
I used a file named q28333414.txt containing your data for my testing.
The first process simply throws away each (space-delimited) parameter between the . and : until there are exactly two left - the required hexval and the drive letter.
The report process re-attaches the drive letter and encloses it and the .exe name in quotes. the for %%r picks the first string, shucks off the quotes, spits out the result and all's done.
Edit : fixed report to show name and extension of file only as required and dbenham comment
Breaking news: (literally!)
#ECHO OFF
SETLOCAL enabledelayedexpansion
FOR /f "delims=" %%a IN (q28333414.txt) DO SET "line=%%~a"&CALL :process "!line::=" "!"
)
GOTO :EOF
:process
SET "hexval=%~3"
IF DEFINED hexval shift&GOTO process
CALL :lastbar1 %%~1
SET "filename=%~2"
SET filename="c:%filename:.exe =.exe" %
FOR %%r IN (%filename%) DO ECHO %hexval% %%~nxr&GOTO :eof
GOTO :eof
:lastbar1
SET "hexval=%~3"
IF DEFINED hexval shift&GOTO lastbar1
SET "hexval=%~1"
GOTO :eof
OK - let's try this, then.
For each line, replace all evil colons with " " and pass resultant quoted-string sequence to a subroutine.
Shift the parameters until there are but 2, which will be the string before and after the final countdown - er, colon.
Repeat the process for the first parameter. The penultimate value is the required hexval.
with the second parameter, add "c: before and " after any .exe, so the result is a quoted full-filename and dross; spit out the hexval and filename and done...
small revision in the rather dim light of the "&" comment - the famous set "var=whatever" formula fails with & included in this case (as in subdirectory "Documents & Settings") so the enclosing quotes can be removed as trailing spaces are not relevant. Would have been useful to know what the test data triggering the problem was though - reduces guesswork.

Answer 2

Any good regex utility you can lay your hands on should be able to solve your problem. I like to use my JREPL.BAT hybrid JScript/batch utility. It is pure script that runs natively on any Windows machine from XP onward.
Assuming your file is test.log, then I would use:
jrepl ".* (0x[0-9A-F]+) C:\\Program Files \(x86\)\\(?:.*\\)?([^\\]+\.exe) .*" "$1 $2" /i /f test.log
On each line it looks for the last occurrence of a hex string sandwiched by spaces that precedes a file path that begins with "C:\Program Files (x86)\" and ends with ".exe". I made the search ignore case.

Answer 3

This solution assumes that there are not backslashes into the random string.
#echo off
setlocal EnableDelayedExpansion
for /F "tokens=1-5 delims=\" %%a in (logFile.txt) do (
rem Extract the HEX value
for %%A in (%%~a) do (
set "value=!lastButOne!"
set "lastButOne=%%A"
)
rem Extract the file name
for /F %%A in ("%%e") do set "name=%%A"
echo !value! !name!
)

Answer 4

Here's a hybrid batch + JScript script (but still a .bat file) that will perform a regexp replace similar to NextInLine's PowerShell solution.
#if (#CodeSection == #Batch) #then
#echo off
setlocal
set "logfile=test.log"
rem // Ask JScript to parse log. On each line, %%I = hex. %%J = exe.
for /f "tokens=1*" %%I in ('cscript /nologo /e:JScript "%~f0" "%logfile%"') do (
echo %%I %%J
)
rem // End main runtime.
goto :EOF
#end
// JScript chimera portion
var fso = WSH.CreateObject('Scripting.FileSystemObject'),
log = fso.OpenTextFile(WSH.Arguments(0), 1);
while (!log.AtEndOfStream) {
var line = log.ReadLine();
WSH.Echo(line.replace(/^.+(0x[0-9a-f]+) \w:\\.+?\\(\w+\.exe).+$/i, "$1 $2"));
}
log.Close();
Course if I were in your boat I'd probably use GnuWin32 sed.
sed -r -e "s/^.*(0x[a-f0-9]+) \w:.+\\(.+\.exe).*$/\1 \2/i" test.log
Just for giggles, I ran some time tests of each fully-working solution against the O.P.'s test log file above, running each several times and getting the mode duration (the result occurring most often).
Aacini's solution: 0.013s (Excellent, but depends on narrow matches)
sed: 0.015s (simplest)
Magoo's solution: 0.034s (clever!)
my JScript hybrid: 0.034s (the best, of course)
dbenham's jrepl.bat: 0.051s (powerful Swiss army knife solution)
NextInLine's PowerShell: hanged my timer script, but felt like about a half a second after the initial painful priming of PowerShell

Answer 5

This is really a task that calls for regular expressions, and for regular expressions at the windows command-line you want powershell. Fortunately, you can run powershell from a batch file or the DOS command-prompt:
powershell -Command "(Get-Content 'c:\full_path_here\input.log') -replace '.+?(0x[0-9a-f]{3}) .+?\\([^\\]+\.exe).*', '$1 $2'"
This has a few parts
powershell -Command runs the entire expression in quotation marks as though it were run from the powershell command line
Get-Content is like the linux cat command - it reads the entirety of the file contents
-replace uses regular expressions to replace the content on each line of the file with the two matched expressions in parentheses