Regex searching for time doesn't want to be non-greedy

Question

I'm trying to run a regex in Spiceworks to parse through email headers to select the first instance of time for ticket assignment purposes. The regex itself works, but it picks up all instances of time rather than just one.

Here's the regex: \.*(0[1]|1[3-7]):\d\d:\d\d

I've tried to make in non-greedy by doing this: \.*?(0[1]|1[3-7]):\d\d:\d\d but that doesn't seem to work. Putting the question mark in front of a quantifier didn't do anything for this purpose.

What is a good solution to make this regex non-greedy or pick up only the first instance?

Thanks,

Andrew N.

Edit: What I'm trying to achieve from the regex is something like "13:04:57" instead of the whole date.

Sample string: Received: by 127.0.0.1 with SMTP id co5csp22954317qdb; Wed, 6 May 2015 13:02:22 -0700 (PDT) X-Received: by 127.0.0.1 with SMTP id j185mr26699743oig.68.1430928141923; Wed, 06 May 2015 13:02:21 -0700 (PDT)

Please add these sample strings to the question and add expected output. Also, does `((?:0[1-9]|1[0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]).*` help? Just grab the contents of the first capturing group. — Wiktor Stribiżew, Jun 04 '15 at 16:47
stribizhev - that one still returns two matches (in that snip of header). — user3761389, Jun 04 '15 at 16:59
@user3761389: My regex above will return the whole string after the time, but the value is inside a capturing group. — Wiktor Stribiżew, Jun 04 '15 at 17:16
I must have been using a different regex tester. I see what you mean now. Looks like also does what I am after. Thanks! — user3761389, Jun 04 '15 at 19:20

score 1 · Accepted Answer · answered Jun 04 '15 at 17:15

1

You can use this lookahead based regex to match first instance of the time matched by your regex:

/^(?:(?!(?:0[1]|1[3-7]):\d\d:\d\d).)*((?:0[1]|1[3-7]):\d\d:\d\d)/m

(?!...) is a negative lookahead that makes sure there is no other instance of time before matching a time thus matching only first instance.

RegEx Demo

answered Jun 04 '15 at 17:15

anubhava

761,203
64
569
643

1

That did it. Thank you! – user3761389 Jun 04 '15 at 17:26
Also, how would you start parsing from the very first instance of this? I noticed that I was taking further down the page a time from some other area (that would have matched the regex: Received: by (ip) with SMTP id (id); Wed, 6 May 2015 08:58:05 -0700 (PDT) – user3761389 Jun 04 '15 at 17:34
`08:58:05` should match in that line also. You can play with my demo link and provide a sample data there. – anubhava Jun 04 '15 at 17:37

score 0 · Answer 2 · answered Jun 04 '15 at 16:16

0

{1} is match the previous pattern 1 time. If you post a sample header I could test the REGEX to ensure I am getting everything correct. Try the following.

(.*(0[1]|1[3-7]):\d\d:\d\d){1}

answered Jun 04 '15 at 16:16

Nathan

3,082
1
27
42

Regex searching for time doesn't want to be non-greedy

2 Answers2