08-30-2006 08:03 AM - edited 03-10-2019 03:11 AM
If I want to match a string for the following, what should my regex value be? Would it accept a space?
user 1 1
-or-
get setup_
I'm trying to find documentation that tells me how to use a space in the regex.
Thanks in advance
08-30-2006 09:29 AM
Have you tried pressing the spacebar;-)
[Uu][Ss][Ee][Rr] 1 1
Another trick, one that Cisco often uses, is to enclose the space in brackets like so:
"[Uu][Ss][Ee][Rr][ ]1[ ]1"
It shouldn't make a difference in terms of matching, but it makes the regex more readable.
08-30-2006 01:06 PM
We will actually stay away from a space inside brackets and use the hex representation \x20. It comes down to readability for us - a single space or a double space inside brackets looks very similar, but you can't mistake the hex:
[Uu][Ss][Ee][Rr]\x20[1]\x20[1]
08-30-2006 02:19 PM
That's a good point. Is that a new standard because there are lots of sigs with a [ ] in the regex.?
08-30-2006 02:25 PM
So you're saying that it will accept just a plain space?
For example, if I wanted it to hit on lowercase only the following would work?
get setup_
08-31-2006 04:29 AM
yes
08-31-2006 05:02 AM
I don't know if I'd go call it a standard. We (meaning the sig team) tend to use the hex value (\x20) because it's a clearly definitive "thing" to represent one space, and one space only. We do it simply because there's no mistaking exactly what it is.
Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: