Using PowerShell Split & regex to return everything after a regex match

user_11735103 0
Viewed 54

Going through PowerShell logs, I'm attempting to extract the commands while discarding the path the command was ran from. For example,

PS C:\Windows\system32> pwd

I'd only like to return pwd. I know this can be accomplished with .split, but I'm struggling to get the regex working. The path will vary, so building a regex off a specific path will not work. My attempt right now is to match the string between "PS" and "> ", such as the regex here (?<=(PS)).*(?=(> )). However this causes unintended results when the path has the letters 'ps' in it.

Splitting off of > is not wanted either, since if a command has > in it then I don't want to trim the actual command.

powershell regex c#
2 Answers

Simply take the line, split it and take the last - no regex required if you want it that way

(("PS C:\Windows\system32> pwd") -split "> ",2)[-1]

Not the best regex, but will do the job:

("PS C:\Windows\system32> pwd") -replace "^.*?> ",""

Edit: changed regex as mentioned in comment - escaping unnecessary for ">"

user_172777160

Are you wanting to use RegEx to do the extracting of the command?

Try this:

$Line = 'PS C:\Windows\system32> pwd'
if($Line -match '(?i)ps [a-z]:(?:\\[a-z0-9]+)+>(?<Cmd>.*)') {
    $Matches.Cmd
}

Returns pwd. Place a space between >( to remove the leading space.

user_41905640
Related