<![CDATA[RegEx - Finding strings when another substring not present]]>I am trying to parse an IIS log in Notepad++ so that it returns the From address when the log line does not contain OutboundConnectionCommand.

2023-03-07 01:30:24 1.2.3.4 OutboundConnectionCommand SMTPSVC1 SERVER01- 0 MAIL - FROM:<any_name@abc.com>+SIZE=933660 0 0 4 0 141 SMTP - - - -

2023-03-07 01:30:24 1.2.3.4Server02.abc.com SMTPSVC1 SERVER01 1.2.3.4 0 MAIL - +FROM:<any_name@abc.com> 250 0 60 47 0 SMTP - - - -

I want to return

From:<any_name@abc.com>

if OutboundConnectionCommand does not exist in the line. I assume I would have to use a negative lookbehind, but I cannot quite get the command correct.

Tried this in regex101.com but it looks like it matches both From: strings:

FROM:.*>(?<!\bOutboundConnectionCommand\b)
]]>https://community.notepad-plus-plus.org/topic/24240/regex-finding-strings-when-another-substring-not-presentRSS for NodeWed, 22 Apr 2026 08:32:25 GMTFri, 10 Mar 2023 16:25:37 GMT60<![CDATA[Reply to RegEx - Finding strings when another substring not present on Wed, 21 Jun 2023 19:33:52 GMT]]>@Alan-Kilborn just adding that the version that I was using did not have the option in Mark to Copy Marked Text. I was one version behind. Upgrading Notepad++ gave me that option.

]]>https://community.notepad-plus-plus.org/post/87302https://community.notepad-plus-plus.org/post/87302Wed, 21 Jun 2023 19:33:52 GMT<![CDATA[Reply to RegEx - Finding strings when another substring not present on Tue, 21 Mar 2023 22:01:37 GMT]]>@Mark-Olson said in RegEx - Finding strings when another substring not present:

The \K operator for forgetting all the text found so far is really cool and I’m glad I learned about it.

Not strictly necessary for the above, though.
If this wasn’t an “evolved” solution I probably wouldn’t have used it.
But it was a matter of “where are we now”…ok…CANCEL with \K!

]]>https://community.notepad-plus-plus.org/post/85060https://community.notepad-plus-plus.org/post/85060Tue, 21 Mar 2023 22:01:37 GMT<![CDATA[Reply to RegEx - Finding strings when another substring not present on Tue, 21 Mar 2023 21:26:19 GMT]]>The \K operator for forgetting all the text found so far is really cool and I’m glad I learned about it.

]]>https://community.notepad-plus-plus.org/post/85059https://community.notepad-plus-plus.org/post/85059Tue, 21 Mar 2023 21:26:19 GMT<![CDATA[Reply to RegEx - Finding strings when another substring not present on Tue, 21 Mar 2023 19:13:47 GMT]]>@Zeff-Wheelock-0 said in RegEx - Finding strings when another substring not present:

I had the previous version of Notepad++. Upgraded to the new version

I don’t think an upgrade had anything to do with it, but it is good that you have some satisfaction!

]]>https://community.notepad-plus-plus.org/post/85055https://community.notepad-plus-plus.org/post/85055Tue, 21 Mar 2023 19:13:47 GMT<![CDATA[Reply to RegEx - Finding strings when another substring not present on Tue, 21 Mar 2023 19:06:14 GMT]]>@Alan-Kilborn
Thanks! I had the previous version of Notepad++. Upgraded to the new version and your solution worked flawlessly and fast! Thanks for the help!

]]>https://community.notepad-plus-plus.org/post/85054https://community.notepad-plus-plus.org/post/85054Tue, 21 Mar 2023 19:06:14 GMT<![CDATA[Reply to RegEx - Finding strings when another substring not present on Tue, 21 Mar 2023 13:14:01 GMT]]>@Zeff-Wheelock-0 said in RegEx - Finding strings when another substring not present:

that just blanked out the whole line

Hmm, my testing shows that it replaces the line with ONLY the email address.

get the email address

But we don’t know what this means.
Maybe your goal isn’t replacement in the original file…

If you literally mean you just want a copy of the email addresses that match the criteria you’ve previously outlined, I’d suggest a Mark operation followed by a Copy Marked Text operation followed by a paste (somewhere else).

c65cc211-7bf4-49f0-8e3f-e66c8dbc85b7-image.png

Find: (?-is)^.*?OutboundConnectionCommand.*?FROM:<\K.+?(?=>)

Press Mark All.
Press Copy Marked Text.
Move to new tab; paste:

5753d674-bf64-416c-af22-df29e6e6847e-image.png

]]>https://community.notepad-plus-plus.org/post/85046https://community.notepad-plus-plus.org/post/85046Tue, 21 Mar 2023 13:14:01 GMT<![CDATA[Reply to RegEx - Finding strings when another substring not present on Tue, 21 Mar 2023 12:14:50 GMT]]>@Alan-Kilborn
Unfortunately, that just blanked out the whole line. I am trying to match any line that contains the bolded content and get the email address within the Less Than/Greater Than delimiters:

2023-03-07 01:30:24 1.2.3.4 OutboundConnectionCommand SMTPSVC1 SERVER01- 0 MAIL - FROM:<return_email_address_between_delimiters@abc.xyz>+SIZE=933660 0 0 4 0 141 SMTP - - - -

Thanks for helping me out!

]]>https://community.notepad-plus-plus.org/post/85045https://community.notepad-plus-plus.org/post/85045Tue, 21 Mar 2023 12:14:50 GMT<![CDATA[Reply to RegEx - Finding strings when another substring not present on Mon, 20 Mar 2023 17:59:58 GMT]]>@Zeff-Wheelock-0

I’ve sort of lost track of what the full need is, but I think you can match the entire line with the email address into capture group 1 with:

Find: (?-is)^.*?OutboundConnectionCommand.*?FROM:<(.+?)>.*

Then you might replace with ${1} ?

Again, a lot of info, so I can’t really pick off what is needed.

]]>https://community.notepad-plus-plus.org/post/85032https://community.notepad-plus-plus.org/post/85032Mon, 20 Mar 2023 17:59:58 GMT<![CDATA[Reply to RegEx - Finding strings when another substring not present on Mon, 20 Mar 2023 17:52:42 GMT]]>@Alan-Kilborn
I apologize for that. After seeing your answer, I realized that I probably needed to add more context than the original ask.

I have tried:

(?=.*\bOutboundConnectionCommand\b)(?=.*FROM)(?<=\<).*(?=\>)

But it seems to select the entire line. Am I close?

]]>https://community.notepad-plus-plus.org/post/85031https://community.notepad-plus-plus.org/post/85031Mon, 20 Mar 2023 17:52:42 GMT<![CDATA[Reply to RegEx - Finding strings when another substring not present on Mon, 20 Mar 2023 16:25:20 GMT]]>@Zeff-Wheelock-0 said in RegEx - Finding strings when another substring not present:

extract the email addresses on all lines that had OutboundConnectionCommand

This is different in a big way from your original request.
Evolving needs tends to confuse those offering help…
But it appears you are well on your way to solving your own problem, so that’s great!

]]>https://community.notepad-plus-plus.org/post/85029https://community.notepad-plus-plus.org/post/85029Mon, 20 Mar 2023 16:25:20 GMT<![CDATA[Reply to RegEx - Finding strings when another substring not present on Mon, 20 Mar 2023 16:18:04 GMT]]>I have figured out how to find the line I want using:

(?=.*\bOutboundConnectionCommand\b)(?=.*FROM)

Now I just need to extract the email between the < and >

]]>https://community.notepad-plus-plus.org/post/85028https://community.notepad-plus-plus.org/post/85028Mon, 20 Mar 2023 16:18:04 GMT<![CDATA[Reply to RegEx - Finding strings when another substring not present on Mon, 20 Mar 2023 15:15:40 GMT]]>@Alan-Kilborn
Thanks for the RegEx. We are getting closer to what I would like. I tried your solution and it successfully selects the entire line. I apologize that I did not include the entire situation. The IIS log tells of all the emails that come into it and get sent out. So, for each email, there will be an incoming and an outgoing entry. Before, I was just extracting the email addresses, but I realized that I was double counting the email addresses (incoming and outgoing). So, I figured I would try and extract the email addresses on all lines that had OutboundConnectionCommand (the emails that are leaving IIS) and try and extract the email address between the FROM:< and the ending >. Can NotePad++, using RegEx (I assume), find the line as you noted in your reply, extract the email address between FROM:< and > ?

I would assume that the replace line would be something along the lines of \r\n<regex of email address>\r\n so then I can apply the bookmarking of that line that would then facilitate me removing all unmarked bookmarks.

]]>https://community.notepad-plus-plus.org/post/85026https://community.notepad-plus-plus.org/post/85026Mon, 20 Mar 2023 15:15:40 GMT<![CDATA[Reply to RegEx - Finding strings when another substring not present on Fri, 10 Mar 2023 18:11:29 GMT]]>@Zeff-Wheelock-0

Probably this matches what you want?:

Find: (?-is)^(?!.*OutboundConnectionCommand).*?FROM:<any_name@abc\.com>
Search mode: Regular expression

]]>https://community.notepad-plus-plus.org/post/84772https://community.notepad-plus-plus.org/post/84772Fri, 10 Mar 2023 18:11:29 GMT