RegEx Question

I have a RegEx pattern style that I haven’t quite mastered yet. Say you have a process line with two sets of numbers in which both are variable. I need one specific set even though both the PID and Byte sizes are variable in size.

  • SORRY THIS LOOKS WEIRD due to Forum Formatting issues :frowning:
    Example:
WmiPrvSE.exe                          2956 Services                   0      6,320 K
IntelligentCollectorParse     1068 Console                    1     11,472 K
conhost.exe                              2320 Console                   1      4,672 K
ICP.exe                                       560 Console                      1     11,340 K   <-- *** This Line
conhost.exe                             1632 Console                    1      4,556 K
tasklist.exe                               1484 Console                    1      5,168 K

I need the 560 only from the ICP.exe line. I can’t find the right Pattern style to grab this.

The Best I can do so far is this for 1,2,3 or 4 digits matches. I feel like this isn’t the most scalable… :slight_smile:

\\\\Grab CorrectLine
(?:ICP.exe).+?

\\\\ Grab Correct Process ID
(?<=\\s)(?:\\d\\d\\d\\d)(?=\\s)|(?<=\\s)(?:\\d\\d\\d)(?=\\s)|(?<=\\s)(?:\\d\\d)(?=\\s)|(?<=\\s)(?:\\d)(?=\\s)

Why not just:

^ICP.exe\\x20+(\\d+)

“560” will be in SubExpressionString( 1 ).

Kem is the \x20 allowing 20 spaces? I’m not familiar with that argument.

Thank you for the answer as I think in regex to many times in multiple Steps rather than in one step.

[quote=96515:@Kem Tekinay]Why not just:

^ICP.exe\\x20+(\\d+)

“560” will be in SubExpressionString( 1 ).[/quote]
Oh I am using RegExRx right now also.

\\x20 is equivalent to Chr( &h20 ), so it represents a space. \\x20+ means “one or more spaces”. I could have done it like +, but I feel that’s clearer.

You can represent any Unicode character with \\xNN or \\x{N…} where N represents the hexadecimal code point.

Ah Thanks! I just found that under your “Search Pattern” in RegExRx.