A word character is any letter, number, or underscore matched by the regular-expression class \w. It excludes punctuation and whitespace; \W matches the opposite set. section 21.2
Use word-character classes to describe changing text in a pattern:
- \w matches one word character, so \won can match Don, Ron, or ton. section 21.2
- \W matches whitespace and punctuation, making [\w\W]+ a way to match one or more characters of any kind. section 21.4
- Include both classes when text may contain punctuation such as a hyphen, which \w alone would not match. section 21.4
Searching log and event text
In PowerShell, Select-String uses 10\.0;[\w\W]+\+Gecko to find log lines containing Windows NT 10.0 user-agent text followed by +Gecko. A related event-log pattern, WIN[\W\w]+TM[234][0-9]\$, allows punctuation between the account prefix and suffix. section 21.4
PS C:\logfiles> get-childitem -filter *.log -recurse |
Select-string -pattern "10\.0;[\w\W]+\+Gecko"
W3SVC1\u_ex120420.log:14:2012-04-20 21:45:04 10.211.55.30 GET /MyApp1/Testpage.asp
- 80 - 10.211.55.29 Mozilla/5.0+(Windows+NT+10.0;+WOW64;+rv:11.0)+Gecko/20100101+Firefox/11.0 200 0 0 1125
W3SVC1\u_ex120420.log:15:2012-04-20 21:45:04 10.211.55.30 GET /TestPage.asp
- 80 - 10.211.55.29 Mozilla/5.0+(Windows+NT+10.0;+WOW64;+rv:11.0)+Gecko/20100101+Firefox/11.0 200 0 0 1 109
Inspect a Select-String command and matching IIS log output that uses [\w\W]+ to span the user-agent text. section 21.4
