G'day zerodmg,

Welcome to the Monastery.

I see you've got a solution to your immediate problem. My post suggests an alternative way of extracting the same data.

Instead of performing multiple matches on the same string, you could do all the matches, and collect all the data, in one pass using alternating named captures. These were introduced in v5.10 (perl5100delta: Named Capture Buffers) so you'll need at least that version of Perl.

Here's some example code with three test subjects: your original; your original with some fields in different positions; and your original with some fields missing. Note that the data is output in the same order regardless of the order it appears in the subject line: this is useful not just for simple output, as I have here, but also in many other situations, such as writing to a CVS file, displaying in an HTML table, using in an SQL insert statement, and so on. Also note that missing data elements are identified and highlighted.

#!/usr/bin/env perl

use 5.010;
use strict;
use warnings;

my @test_subjects = (
    '--[RV: vRealize Operations Manager] new alert Type:Virtualization
+/Hypervisor, Sub-Type:Availability, State:critical, Object Type:VMwar
+eAdapter Instance, Name:HOSTVCENTER01 from 192.168.1.121---',
    '--[RV: vRealize Operations Manager] new State:critical, Object Ty
+pe:VMwareAdapter Instance, alert Type:Virtualization/Hypervisor, Sub-
+Type:Availability, Name:HOSTVCENTER01 from 192.168.1.121---',
    '--[RV: vRealize Operations Manager] new alert Type:Virtualization
+/Hypervisor, State:critical, Name:HOSTVCENTER01 from 192.168.1.121---
+',
);

my $subject_re = qr{(?x:
    (?>
            Manager ] \s+   (?<event>   \S+     )
        |   alert \s Type:  (?<type>    [^,]+   )
        |   Sub-Type:       (?<subtype> [^,]+   )
        |   State:          (?<state>   [^,]+   )
        |   Object \s Type: (?<object>  [^,]+   )
        |   Name:           (?<host>    \S+     )
        |   from \s+        (?<from>    [0-9.]+ )
    )
)};

my @fields = qw{event type subtype state object host from};
my $format = '%-'
           . (length((sort { length $b <=> length $a } @fields)[0]) + 
+1)
           . "s %s\n";
my $pre_subject  = '=== Subject ' . '=' x 30;
my $post_subject = '=' x 42;
my %empty; @empty{@fields} = ('Not supplied!') x @fields;

for my $subject (@test_subjects) {
    my %captured;

    while ($subject =~ /$subject_re/g) {
        $captured{$_} = $+{$_} for keys %+;
    }

    my %found = (%empty, %captured);

    say for $pre_subject, $subject, $post_subject;
    printf $format, "$_:", $found{$_} for @fields;
}
[download]

Here's the output:

=== Subject ==============================
--[RV: vRealize Operations Manager] new alert Type:Virtualization/Hype
+rvisor, Sub-Type:Availability, State:critical, Object Type:VMwareAdap
+ter Instance, Name:HOSTVCENTER01 from 192.168.1.121---
==========================================
event:   new
type:    Virtualization/Hypervisor
subtype: Availability
state:   critical
object:  VMwareAdapter Instance
host:    HOSTVCENTER01
from:    192.168.1.121
=== Subject ==============================
--[RV: vRealize Operations Manager] new State:critical, Object Type:VM
+wareAdapter Instance, alert Type:Virtualization/Hypervisor, Sub-Type:
+Availability, Name:HOSTVCENTER01 from 192.168.1.121---
==========================================
event:   new
type:    Virtualization/Hypervisor
subtype: Availability
state:   critical
object:  VMwareAdapter Instance
host:    HOSTVCENTER01
from:    192.168.1.121
=== Subject ==============================
--[RV: vRealize Operations Manager] new alert Type:Virtualization/Hype
+rvisor, State:critical, Name:HOSTVCENTER01 from 192.168.1.121---
==========================================
event:   new
type:    Virtualization/Hypervisor
subtype: Not supplied!
state:   critical
object:  Not supplied!
host:    HOSTVCENTER01
from:    192.168.1.121
[download]

[Aside: You'll note that in your post, what you intended to be "[vRealize Operations Manager]", appears as a link without the brackets. This is one way that you can create links (see "What shortcuts can I use for linking to other information?"). If you actually want the brackets displayed, use &#91; for [ and &#93; for ]; alternatively, put the whole subject line within <code>...</code> tags which, in this instance, would have been a better option as it allows us to download a verbatim copy of your data (see "Writeup Formatting Tips"). You can edit your post to fix this (see "How do I change/delete my post?").]

---

---

Posts are HTML formatted. Put <p> </p> tags around your paragraphs. Put <code> </code> tags around your code and data!

Titles consisting of a single word are discouraged, and in most cases are disallowed outright.

Read Where should I post X? if you're not absolutely sure you're posting in the right place.

Please read these before you post! —

• How do I compose an effective node title?
• How do I post a question effectively?
• Markup in the Monastery

Posts may use any of the Perl Monks Approved HTML tags:

a, abbr, b, big, blockquote, br, caption, center, col, colgroup, dd, del, details, div, dl, dt, em, font, h1, h2, h3, h4, h5, h6, hr, i, ins, li, ol, p, pre, readmore, small, span, spoiler, strike, strong, sub, summary, sup, table, tbody, td, tfoot, th, thead, tr, tt, u, ul, wbr

You may need to use entities for some characters, as follows. (Exception: Within code tags, you can put the characters literally.)

	For:		Use:
	&		&
	<		&lt;
	>		&gt;
	[		&#91;
	]		&#93;

Link using PerlMonks shortcuts! What shortcuts can I use for linking?

See Writeup Formatting Tips and other pages linked from there for more info.