Hello.

I have an ipconfig /all dump. I want to pull both the host name and the ip address from the data.

I can do this in two different rules.


is it possible to do in one rule?


So for example I have a rule named ipconfig results.
In the rule I do a search for
Host Name . . . . . . . . . . . . : ??????????????????????
and
IP Address. . . . . . . . . . . . : ???????????????

(each of these strings give me what I need in their own rules.



Let me expand a little two. Im set to search multiple txt files for this data.

Yes, just use a regular expression to do this. You should be able to find help on getting the pattern on the web.