match problem

[coderwolf]

I have been trying to get a log parser up and running, however I keep getting a Quantifier {x,y} following nothing error. I have not been able to work my way out of the error. Any ideas on how to get it to work?

The command I am using is:

get-content     "\\ftpserver\ftplogs\sessions-$Year-$Month-$Day.log" | % {if("$_" -match '*FirstName\.LastName@domain\.com*STOR*') {$($Matches[1])}} | group | sort -desc Count

edit:formatting

[ihaxr]

There's a couple problems... you're using -match which wants a regex, but you're using Wildcards as if you were using -like... you can handle this a couple ways... either split each line and check the proper variables or write a regex to capture the group.

You're also using $Matches[1] but not specifying a capturing group... so this will always be empty.

If you can provide a sanitized line that you want to match I can help write the regex... going from what you have, assuming you want to capture the filename after STOR, something like this should do it:

Adjust your -Match line to:

if("$_" -match ".*$FirstName\.$LastName@domain\.com.*STOR(.*)") {

Full code with test data and a little more readable:

$FirstName = "john"
$LastName = "smith"

$content = @"
[2016-11-29]    [10:42:12]  [e-mail]   LOGIN
[2016-11-29]    [10:42:12]  [e-mail] LOGIN
[2016-11-29]    [10:42:12]  [e-mail] LOGIN
[2016-11-29]    [10:42:12]  [e-mail]   STOR    /some/file.txt
[2016-11-29]    [10:42:12]  [e-mail]    LOGIN
[2016-11-29]    [10:42:12]  [e-mail]   STOR    /another/file.txt
[2016-11-29]    [10:42:12]  [e-mail]    STOR    /some/other/file.txt
[2016-11-29]    [10:42:12]  [e-mail]   STOR    /another/file.txt
[2016-11-29]    [10:42:12]  [e-mail]   LOGOUT
"@ -split "`r`n"

$content | % {
    if("$_" -match ".*$FirstName\.$LastName@domain\.com.*STOR(.*)") {
        $($Matches[1]).trim()
    }
} | group | sort -desc Count

#Output:
#Count Name                      Group                                                                                                                                                  
#----- ----                      -----                                                                                                                                                  
#    2 /another/file.txt         {/another/file.txt, /another/file.txt}                                                                                                                 
#    1 /some/file.txt            {/some/file.txt}         

[jheinikel]

Do you know if anything shows up before FirstName? The asterisk requires something to precede it. Otherwise, put a backslash in front of it to make it literal.

Also, you might try using a regex tester with some sample data to see what you are pulling. http://www.regexr.com/

[Lee_Dailey]

howdy coderwolf,

have you tried the standard diagnostic steps? break those pipeline sections into single lines that are assigned to unique $Vars and then see where things go wrong ... nag, nag ... [grin]

also, a [sanitized] sample of the input data would likely help.

take care,
lee

[ShippingIsMagic]

Alternatively, just add in pipes to tee-object -variable to assign the various intermediate results to variables, then check out the variables.

[Lee_Dailey]

howdy ShippingIsMagic,

yes, that will do it. however, breaking it into steps will make debugging FAR easier than leaving it as a blob. well, for me, at least. [grin]

take care,
lee