# Select-String & RegEx

**URL:** <https://forums.powershell.org/t/select-string-regex/7280>\
**Category:** PowerShell Help\
**Created:** [September 29, 2016, 8:54am UTC](https://forums.powershell.org/t/select-string-regex/7280 "2016-09-29T08:54:43Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![johnny-leuthard](https://avatars.discourse-cdn.com/v4/letter/j/a6a055/32.png) [@johnny-leuthard](https://forums.powershell.org/u/johnny-leuthard)\
**Post date:** [September 29, 2016, 8:54am UTC](https://forums.powershell.org/t/select-string-regex/7280/1 "2016-09-29T08:54:43Z")

</div>

I’m having a problem with RegEx. Every time I think I have it down the parameters of what i need to do change and I’m reminded how much RegEx can hurt your brain!

What I am currently trying to do is extract a certain string of an unknown length from a big text file. It’s an event security log from a 3rd party to be exact. for most (if not all) I know the text before and after my string. Here is an example of what I need to look for  
**Subject.Account\_Name: SourceUserName Subject.Account\_Domain: CORP**

From that string I need to extract **SourceUserName** That will change for each line.

I have multiple logs that i need to parse through and for the most part know the beginning and ending string.  
Can anybody help with the RegEx search OR if there is a suggestion on a better way to do this i am open.

---

<div class="post-metadata">

**Author:** ![Olaf](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.powershell.org/olaf/32/992_2.png) [@Olaf](https://forums.powershell.org/u/Olaf)\
**Post date:** [September 29, 2016, 9:33am UTC](https://forums.powershell.org/t/select-string-regex/7280/2 "2016-09-29T09:33:16Z")

</div>

The regex is the easiest part I think:

```
'Subject.Account_Name: SourceUserName Subject.Account_Domain: CORP' -match 'Subject\.Account_Name:\s+(.+)\s+Subject\.Account_Domain:\s+CORP'
$Matches[1]
```

For the rest you should do a foreach loop and do whatever you need to do with the results.  
If you have some trouble with your code you can come back and we’re gona help you. 😉

---

<div class="post-metadata">

**Author:** ![brandon-berne](https://avatars.discourse-cdn.com/v4/letter/b/a3d4f5/32.png) [@brandon-berne](https://forums.powershell.org/u/brandon-berne)\
**Post date:** [September 29, 2016, 9:36am UTC](https://forums.powershell.org/t/select-string-regex/7280/3 "2016-09-29T09:36:51Z")

</div>

Something akin to:

```
ls c:\temp\searchfolder -recurse | Select-String "google" | Select Path, LineNumber | Format-List OR $Regex = "\b\D*([\d]{1,}).*\b"
```

Perhaps this may help? [RegEx Searches](http://rubular.com/r/VLN0gwKbV1) I’m no expert but I seen the question figured I’d try run through some oddball searches of google in hopes of helping.

---

<div class="post-metadata">

**Author:** ![random-commandline](https://avatars.discourse-cdn.com/v4/letter/r/e56c9b/32.png) [@random-commandline](https://forums.powershell.org/u/random-commandline)\
**Post date:** [September 29, 2016, 9:44am UTC](https://forums.powershell.org/t/select-string-regex/7280/4 "2016-09-29T09:44:59Z")

</div>

I recommend using the switch statement as it can be more efficient compared to Get-Content depending on the size and number of log files.

```
$logs = Get-ChildItem \path\to\logfiles\logs*
$strings = foreach ($log in $logs){
switch -Regex -File $log{
'Account_Name: (.*) Subject' {$Matches[1]}
}}
$strings
```

---

<div class="post-metadata">

**Author:** ![dotnVo](https://avatars.discourse-cdn.com/v4/letter/d/4af34b/32.png) [@dotnVo](https://forums.powershell.org/u/dotnVo)\
**Post date:** [May 16, 2024, 8:40pm UTC](https://forums.powershell.org/t/select-string-regex/7280/5 "2024-05-16T20:40:15Z")

</div>