Need help to define a REGEXP - locate a SubString

[Dummy]

I had a problem which is very old too me. I had this problem since few years also on the older Version of Cacti.
I never had solved it but now I like to raise my question. Maybe someone could give me a hint?

Problem:
* I had defined a XML - File for Data Query
* This is running fine. I can get my data defined in the XML and can go on with this.
* There is one Problem using Value/REGEXP for which I'm asking for help:

For one filed, containig the name of the source, I had defined this line:
<source>VALUE/REGEXP:stp_local::sign (\w{1,})\.(\w{1,})</source>

The String found as "Value":
be2_tiu_stp_local::sign NAT0_DEE1HH.NAT0_DEE1HH_local

The result with this REGEXP which is built out of characters and digits fromt the left of the ".":
be2_tiu_NAT0_DEE1HH

My need is to get the Substring which is on the right side of the ".": NAT0_DEE1HH_local

I had used some hours for yome tests with several REGEX - Testing-Tools to find a Rule matching to my need but I'm not successful.
Which is also working, just in REGEX-Testing-Tools, is the Rule: (\w{1,})$ With this I got the Substring right of the "."
But, using this rule in Cacti (in the XML), it is not working as expected.

So, the question is: Are there any suggestions for y matching / working REGEXP to get the substring on the right side of the "." ???

[tertius]

As far as I understand the cacti documentation, the first submatch is used as return value. You defined 2 submatches, the first is the data captured before the . and the second is the data captured after it. You capture a substring by putting () around the expression, so remove the first () and only leave the second pair:
from
<source>VALUE/REGEXP:stp_local::sign (\w{1,})\.(\w{1,})</source>
to
<source>VALUE/REGEXP:stp_local::sign \w{1,}\.(\w{1,})</source>

Shorter would be probably this:
<source>VALUE/REGEXP:stp_local::sign \w+\.(\w+)</source>

[Dummy]

Dear tertius,
thank you for your suggestion. I will try it out next Monday and I will let you know the result.
Thank you

[Osiris]

When you figure this out, it would benefit the entire community if you could write an article in the documentation GitHub.

[Dummy]

Dear tertius,
this was a godd suggestion. It is working and I can use it. I can get the string which is in between the "." and the right end of the String.
Thank you.

But I do not understand the VALUE/REGEXP in general
.... after some search I found (I hope I'm on the right way) that a function called "preg_replace()" will be used to replace values with the given Regexp.
More informations about preg_replace can be found in the Internet. There are some good descriptions and also suggestion how to check this function.

So, my ides: Be smart and check a working REGEXP "Offline" (Outside of Cacti). I did it on the same server on which Cacti is running in CLI-mode.
And I got a solution which was working fine to me in this simulation.

Example:
String 1: be_ani_stp_local::snap Test.Test_local_Point
String 2: be_inu_stp_local::snap New.None_local_Never
Regexp: be_(ani_|inu_)stp_local::snap (\w{1,}\.)

The result:
Modified String 1: Test_local_Point
Modified String 2: None_local_Never

Learned:
Each Character, Digit, String which will be found in the String will be removed. The result will contain the rest which was not found with Regexp.


HaHa, I thought I got it, let's use this Regexp as new Value in the MIB-File:
<source>VALUE/REGEXP:be_(ani_|inu_)stp_local::snap (\w{1,}\.)</source>

then reload the MIB-File in "Management" --> "Devices" and Click on "Verbose"
... and the result:
Verbose String 1: ani_Test_local_Point
Verbose String 2: inu_None_local_Never
You see: the part in Regexp (a|b) "means a OR b" will work different in the simulation on CLI-Mode as in Cacti.

And now I will stop for some time trying to find cause "why".
It might be that my assumption is wrong and Cacti will not use preg_replace().

Maybe someone has any idea which function will be used in Cacti to perform the calculation of the Value with Regexp?

[tertius]

Regular expressions have their own science. If you google for regex, you will find hundredths of thousands of hits.

In general, a regular expression defines a pattern for string matching.
If a regular expression matches, it matches a part of a longer string. In a programming language, this is can be the result of a match function. Sometimes, you want to take this match but return only a part from it. Or multiple parts. For this, submatches exist. They are introduced with parenthesis (). They are not only used for grouping, they are also used for catching submatches. Each opening parenthesis starts a new submatch, which are numbered from 1..9. In cacti, it's hardcoded that in the filter definition you refer to the first submatch is used to return the desired value. So your task is to define a regular expression that contains a submatch that returns the value. So you define a regular expression that describes (matches) the surroundings of your value, and put parenthesis around the actual value description to catch that value.

[TheWitness]

I've been at this Cacti thing for nearly 20 years, and I still have to google (rarely)/duckduckgo (nowadays)/hotbot (in my dreams of days long ago) to figure out the complex stuff. It is a language all it's own that people who are fond of Perl know very well.

[camerabob]

I'm very fond of PERL. I still have to fudge with it a few times before I get it right!

[netniV]

I use regex101.com to work out my base expression, then I tweak it for the language I'm using (PHP, C#, SQL, etc) to get the same results as I do there with a large enough sample set including lines that should not match. I rarely google these days on regex, but I have been known to for super complex things.

[Dummy]

Yes, I agree: regex101.com is a very nice tool I used it also to find a matching Expression for my needs .. but the REGEXP tested with regex101.com and also the results out of direct tests with php (as mentioned above) had not provided the result used as VALUE\REGEXP in Cacti. This is still a miracle to me