Question

I seem to have entered a pretty complex area (to me anyways.)
Lets say I have the following line:

1:11:39 "LOGIN ATTEMPT: "47576966" Arlond"

What I am trying to do is seperate the time(1:11:39) ID(47576966) and name(Arlond). I got as far as the below regex but I am sort of lost at what I need to do next. I understand my regex is incorrect to grab everything I need and that’s where I’ll also need help among getting my For loop to work correctly. I have been looking up on how to regex split and replace but so far I have not had any luck getting anything to work.

([""'])(?:(?=(\\?))\2.)*?\1


Using TestFile As New IO.StreamReader(My.Settings.cfgPath & "tempRPT.txt", System.Text.Encoding.Default, False, 4096)
        Do Until TestFile.EndOfStream
            ScriptLine = TestFile.ReadLine
            ScriptLine = LCase(ScriptLine)
            If InStr(ScriptLine, "login attempt:") Then
                Dim m As MatchCollection = Regex.Matches(ScriptLine, "([""'])(?:(?=(\\?))\2.)*?\1")
                For Each x As Match In m

                Next
                'builder.AppendLine(ScriptLine)
            End If

        Loop
    End Using

Answer 1

With respect to your regular expression, I’ve always found it best to be explicit wherever possible (anchors, for example). Assuming your input data is as well behaved as it looks, you could do something like this:

^(\d{1,2}:\d{2}:\d{2})\s""LOGIN\sATTEMPT:\s""(\d+)""\s([^""]+)""$

Breaking that into its components:

^                       // Anchor: Start of string (or line).
(\d{1,2}:\d{2}:\d{2})   // Capture one or two digits, colon, two digits, colon, two digits.
\s""LOGIN\sATTEMPT:\s"" // Anchor: match (but don't capture) literal text.
(\d+)                   // Match/capture one or more digits. (maybe you could use \d{8} instead).
""\s                    // Anchor: literal text.
([^""]+)                // Match and capture everything that is not a quote.
""                      // Anchor: Literal quote.
$                       // Anchor: End of string (or line).

This breaks down if your name field is allowed to contain the " (double-quote) character. If that turns out to be the case you will have to modify the last subexpression to be more permissive.