I'm trying to parse information in the audit log of a bunch of work tickets, which I've exported to a .CSV file. I've pulled the data into Powershell and am doing my parsing using .NET's regular expression class.
What I want is to detect when a ticket's assigned group was changed. That shows up in the ticket's audit log as "The assigned group was changed to Group_Name", where Group_Name is always some combination of upper/lowercase letters and underscores.
This being the case, the following regex should do it...
The assigned group changed to ([a-zA-Z]+(?:_[a-zA-Z]+)*)
Yet, when I run these tickets' audit logs through that regex, I get nothing. Am I missing something? Is there an option I should be setting someplace? I already tried multiline vs singleline...