Help replacing a portion of a word

Vince Landry

Hey, I’m sure this is simple for you pros but I can’t figure out how to replace a portion of a word with another in this particular instance.

I have -“brvint*” where brv could be any 3 letters.
For example -“misint*” or -“ottint*”
I want to remove each of those lines and replace it with
-tag:“FalconGroupingTags/Domain_Controller”

Any help would be greatly appreciated. Figure it might be easier to add the whole query.

hostname:(("brv*" AND -"brvhost*" AND -"brvint*" AND -"brvatl*" AND -"brvutil*") OR ("che*" AND -"chehost*" AND -"cheint*" AND -"cheatl*" AND -"cheutil*") OR ("chu*" AND -"chuhost*" AND -"chuint*" AND -"chuatl*" AND -"chuutil*") OR ("cin*" AND -"cinhost*" AND -"cinint*" AND -"cinatl*" AND -"cinutil*") OR ("clt*" AND -"clthost*" AND -"cltint*" AND -"cltatl*" AND -"cltutil*") OR ("cos*" AND -"coshost*" AND -"cosint*" AND -"cosatl*" AND -"cosutil*") OR ("dav*" AND -"davhost*" AND -"davint*" AND -"davatl*" AND -"davutil*") OR ("dtn*" AND -"dtnhost*" AND -"dtnint*" AND -"dtnatl*" AND -"dtnutil*") OR ("emd*" AND -"emdhost*" AND -"emdint*" AND -"emdatl*" AND -"emdutil*") OR ("epd*" AND -"epdhost*" AND -"epdint*" AND -"epdatl*" AND -"epdutil*") OR ("est*" AND -"esthost*" AND -"estint*" AND -"estatl*" AND -"estutil*") OR ("fcv*" AND -"fcvhost*" AND -"fcvint*" AND -"fcvatl*" AND -"fcvutil*") OR ("fre*" AND -"frehost*" AND -"freint*" AND -"freatl*" AND -"freutil*") OR ("gst*" AND -"gsthost*" AND -"gstint*" AND -"gstatl*" AND -"gstutil*") OR ("hun*" AND -"hunhost*" AND -"hunint*" AND -"hunatl*" AND -"hunutil*") OR ("kps*" AND -"kpshost*" AND -"kpsint*" AND -"kpsatl*" AND -"kpsutil*") OR ("lce*" AND -"lcehost*" AND -"lceint*" AND -"lceatl*" AND -"lceutil*") OR ("ltn*" AND -"ltnhost*" AND -"ltnint*" AND -"ltnatl*" AND -"ltnutil*") OR ("may*" AND -"mayhost*" AND -"mayint*" AND -"mayatl*" AND -"mayutil*") OR ("mbh*" AND -"mbhhost*" AND -"mbhint*" AND -"mbhatl*" AND -"mbhutil*") OR ("ntw*" AND -"ntwhost*" AND -"ntwint*" AND -"ntwatl*" AND -"ntwutil*") OR ("par*" AND -"parhost*" AND -"parint*" AND -"paratl*" AND -"parutil*") OR ("pbk*" AND -"pbkhost*" AND -"pbkint*" AND -"pbkatl*" AND -"pbkutil*") OR ("pci*" AND -"pcihost*" AND -"pciint*" AND -"pciatl*" AND -"pciutil*") OR ("pic*" AND -"pichost*" AND -"picint*" AND -"picatl*" AND -"picutil*") OR ("psi*" AND -"psihost*" AND -"psiint*" AND -"psiatl*" AND -"psiutil*") OR ("shl*" AND -"shlhost*" AND -"shlint*" AND -"shlatl*" AND -"shlutil*") OR ("sum*" AND -"sumhost*" AND -"sumint*" AND -"sumatl*" AND -"sumutil*") OR ("trc*" AND -"trchost*" AND -"trcint*" AND -"trcatl*" AND -"trcutil*") OR ("wel*" AND -"welhost*" AND -"welint*" AND -"welatl*" AND -"welutil*") OR ("mic*" AND -"michost*" AND -"micint*" AND -"micatl*" AND -"micutil*") OR ("red*" AND -"redhost*" AND -"redint*" AND -"redatl*" AND -"redutil*"))

Mark Olson

@Vince-Landry
See https://npp-user-manual.org/docs/searching/#regular-expressions
If literally all you want is to replace any three letters + int* with -tag:"FalconGroupingTags/Domain_Controller",
the regex is simple:

Find: [a-zA-Z]{3}int\*
Replace: -tag:"FalconGroupingTags/Domain_Controller"
Settings: Match case checked, Wrap around checked, Regular expression selected.

Breakdown of the find-regex:
[a-zA-Z]: any Latin letter (a-z covers lower-case, A-Z covers upper-case)
{3}: three of the preceding pattern (in this case [a-zA-Z])
int: just those three letters, nothing special
\*: * is a special character in regular expressions, so it must be escaped by \ if you want to use it.

BTW, I’m not an expert in regular expressions like guy038 (or many of the other regulars here), but this is a pretty simple case.

I’d strongly encourage you to play around with this regular expression, read the documentation I linked to, and see how changing the regex changes what is found and replaced. The Mark tab on the find/replace form (select Purge for each seach) is particularly handy because it highlights everything that was matched by a regex.

Regular expressions can only really be learned by trial and error, and if you use a nice sandbox like the find/replace form in Notepad++ (not Find in Files, that can totally destroy you if you don’t know what you’re doing), you can get a pretty good feel for how they work.

guy038

Hi, @vince-landry, @mark-olson and All,

I suppose that Mark did a small typo error regarding the search regex ! He forgot the leading part -"

So, here is my solution :

SEARCH (?x-i) - " \l{3} int \* " OR (?-i)-"\l{3}int\*"

REPLACE -tag:"FalconGroupingTags/Domain_Controller"

Settings Wrap around and Regular expression

Action one Replace All or several Replace

Best Regards,

guy038

Vince Landry

@Mark-Olson Thank you so much!