Event Rule Regex

[fley]

Hi Guys,

this has probably been asked and answered many times but I couldn't find the right explanation.

Doing the Event Management Fundamentals Training right now and the Event Rule RegEx is driving me nuts. Spaces don't really seem to matter and I don't seem to get how it is using groups.

Example: 

I want to parse the server name (win-ksx74drkgh) out of the following line;

"Memory Leak on win-ksx74drkgh xxx"

What's the RegEx for this in the Event Rule Designer? Maybe you can also explain why this RegEx doesn't work (regex101 seems to be fine with it):  "Memory Leak on (\w*-\w*)"

Is there smth implicit going on that I should know about, e.g. the Designer seems to accept both

Memory Leak on(.*)

and

Memory Leak on (.*)

in order to capture the server name in "Memory Leak on win-ksx74drkgh"

Thank you 

[Denise Taylor2 · Accepted solution]

Because your regex is searching for something in the middle of the string, you need wildcards on either side
.*(win-ksx74drkgh).*

Check out this post.  As explained there,

The regex for event rules is a bit more sensitive than that and the entire string has to be captured or it would only parse correctly if the entire beginning of the string was exactly the same each time.  The Xplore regex tester unfortunately does not use the same backend regex as event management rules (nor does regex101 or most other popular testers).

However it appears you can configure regex101 to test regex as per ServiceNow EM requirements.  Check out this KB article.