match the sequence between a word and the last occurding space - regex

Question

I am looking to extract specific set of characters matching after a particular word till the last space that occurs in the sequence.
Example:
FAILED on portal HTTP (10.1.1.1)
FAILED on portal TELNET 0 SSH (10.1.1.1)
I want the O/P to be:
HTTP
TELNET 0 SSH
Currently using the following RegEX and working on it:
.+((?<=portal)[^\s]]+
Will be helpful if anyone of you can help me out on this :)
Updated from comment:
Text:
1368028793000 10.3.1.4 CISCO X AUTHENTICATION:SESSION User authentication attempt FAILED on portal TELNET 0 SSH (10.1.2.8:64940)
Regex:
^(\d+).* (\S+\d) ([\w\s]+) (\w* ?AUTHENTICATION:SESSION) (.+) (([\w.]+):(\d+)).*
Typically the groups I would like to have from my sample string would be:
#1 - 1368028793000
#2 - 10.3.1.4
#3 - CISCO X
#4 - AUTHENTICATION:SESSION
#5 - User authentication attempt FAILED on portal
#6 - TELNET 0 SSH
#7 - 10.1.2.8
#8 - 6940

Answer 1

You could maybe try this:
(?<=portal\s)(.+)\s\(
Note that you have a missing closing bracket ) and a missing opening square bracket [, which I assume was a typo. And you need to escape the opening bracket which marks the start of the (10.1.1.1) bit.

Answer 2

All change according to new requirement.
Have a try with:
^(\d+)\s+([\d.]+)\s+([\w\s]+?)\s+(AUTHENTICATION:SESSION)\s+(.+?portal)\s(.+?)\(([\d.]+)(?::(\d+))?\)$
Here is a perl script that runs it:
my $re = qr/^(\d+)\s+([\d.]+)\s+([\w\s]+?)\s+(AUTHENTICATION:SESSION)\s+(.+?portal)\s(.+?)\(([\d.]+)(?::(\d+))?\)$/;
while(<DATA>) {
chomp;
my #l = ($_ =~ $re);
dump#l;
}
__DATA__
1368028793000 10.3.1.4 CISCO X AUTHENTICATION:SESSION User authentication attempt FAILED on portal HTTP (10.1.1.1)
1368028793000 10.3.1.4 CISCO X AUTHENTICATION:SESSION User authentication attempt FAILED on portal TELNET 0 SSH (10.1.2.8:64940)
output:
(
1368028793000,
"10.3.1.4",
"CISCO X",
"AUTHENTICATION:SESSION",
"User authentication attempt FAILED on portal",
"HTTP ",
"10.1.1.1",
undef,
)
(
1368028793000,
"10.3.1.4",
"CISCO X",
"AUTHENTICATION:SESSION",
"User authentication attempt FAILED on portal",
"TELNET 0 SSH ",
"10.1.2.8",
64940,
)
regex explain:
The regular expression:
(?-imsx:^(\d+)\s+([\d.]+)\s+([\w\s]+?)\s+(AUTHENTICATION:SESSION)\s+(.+?portal)\s(.+?)\(([\d.]+)(?::(\d+))?\)$)
matches as follows:
NODE EXPLANATION
----------------------------------------------------------------------
(?-imsx: group, but do not capture (case-sensitive)
(with ^ and $ matching normally) (with . not
matching \n) (matching whitespace and #
normally):
----------------------------------------------------------------------
^ the beginning of the string
----------------------------------------------------------------------
( group and capture to \1:
----------------------------------------------------------------------
\d+ digits (0-9) (1 or more times (matching
the most amount possible))
----------------------------------------------------------------------
) end of \1
----------------------------------------------------------------------
\s+ whitespace (\n, \r, \t, \f, and " ") (1 or
more times (matching the most amount
possible))
----------------------------------------------------------------------
( group and capture to \2:
----------------------------------------------------------------------
[\d.]+ any character of: digits (0-9), '.' (1
or more times (matching the most amount
possible))
----------------------------------------------------------------------
) end of \2
----------------------------------------------------------------------
\s+ whitespace (\n, \r, \t, \f, and " ") (1 or
more times (matching the most amount
possible))
----------------------------------------------------------------------
( group and capture to \3:
----------------------------------------------------------------------
[\w\s]+? any character of: word characters (a-z,
A-Z, 0-9, _), whitespace (\n, \r, \t,
\f, and " ") (1 or more times (matching
the least amount possible))
----------------------------------------------------------------------
) end of \3
----------------------------------------------------------------------
\s+ whitespace (\n, \r, \t, \f, and " ") (1 or
more times (matching the most amount
possible))
----------------------------------------------------------------------
( group and capture to \4:
----------------------------------------------------------------------
AUTHENTICATION:SES 'AUTHENTICATION:SESSION'
SION
----------------------------------------------------------------------
) end of \4
----------------------------------------------------------------------
\s+ whitespace (\n, \r, \t, \f, and " ") (1 or
more times (matching the most amount
possible))
----------------------------------------------------------------------
( group and capture to \5:
----------------------------------------------------------------------
.+? any character except \n (1 or more times
(matching the least amount possible))
----------------------------------------------------------------------
portal 'portal'
----------------------------------------------------------------------
) end of \5
----------------------------------------------------------------------
\s whitespace (\n, \r, \t, \f, and " ")
----------------------------------------------------------------------
( group and capture to \6:
----------------------------------------------------------------------
.+? any character except \n (1 or more times
(matching the least amount possible))
----------------------------------------------------------------------
) end of \6
----------------------------------------------------------------------
\( '('
----------------------------------------------------------------------
( group and capture to \7:
----------------------------------------------------------------------
[\d.]+ any character of: digits (0-9), '.' (1
or more times (matching the most amount
possible))
----------------------------------------------------------------------
) end of \7
----------------------------------------------------------------------
(?: group, but do not capture (optional
(matching the most amount possible)):
----------------------------------------------------------------------
: ':'
----------------------------------------------------------------------
( group and capture to \8:
----------------------------------------------------------------------
\d+ digits (0-9) (1 or more times
(matching the most amount possible))
----------------------------------------------------------------------
) end of \8
----------------------------------------------------------------------
)? end of grouping
----------------------------------------------------------------------
\) ')'
----------------------------------------------------------------------
$ before an optional \n, and the end of the
string
----------------------------------------------------------------------
) end of grouping
----------------------------------------------------------------------

Answer 3

You can use this regex
(?<=portal).+(?=\s)
.+ is greedy so it would match till end and then backtrack if necessary..