Steve’s solution is clearly better than parsing the text. But the question got me thinking about the text parsing puzzle in general, and for any future readers with a more generalized case I came up with a couple of methods of doing it. Both, however, required counting the number of parentheses in the expression.
The first way involves repeated use of following text of first ";"
as in
q: ("VISIO.EXE;Thu, 06 Oct 2016 05:46:33 -0500;Tue, 23 Jan 2018 06:16:23 -0500;Tue, 23 Jan 2018 13:35:05 -0500;TRUE;111 days, 04:31:41.124;422";"WORD.EXE;Thu, 06 Oct 2016 05:46:33 -0500;Tue, 23 Jan 2018 06:16:23 -0500;Tue, 23 Jan 2018 13:35:05 -0500;TRUE;111 days, 04:31:41.124;422")
A: VISIO.EXE;Thu, 06 Oct 2016 05:46:33 -0500;Tue, 23 Jan 2018 06:16:23 -0500;Tue, 23 Jan 2018 13:35:05 -0500;TRUE;111 days, 04:31:41.124;422
A: WORD.EXE;Thu, 06 Oct 2016 05:46:33 -0500;Tue, 23 Jan 2018 06:16:23 -0500;Tue, 23 Jan 2018 13:35:05 -0500;TRUE;111 days, 04:31:41.124;422
T: 0.034 ms
I: plural string
q: preceding texts of firsts ";" of following texts of firsts ";" of following texts of firsts ";" of following texts of firsts ";" of ("VISIO.EXE;Thu, 06 Oct 2016 05:46:33 -0500;Tue, 23 Jan 2018 06:16:23 -0500;Tue, 23 Jan 2018 13:35:05 -0500;TRUE;111 days, 04:31:41.124;422";"WORD.EXE;Thu, 06 Oct 2016 05:46:33 -0500;Tue, 23 Jan 2018 06:16:23 -0500;Tue, 23 Jan 2018 13:35:05 -0500;TRUE;111 days, 04:31:41.124;422")
A: Tue, 23 Jan 2018 13:35:05 -0500
A: Tue, 23 Jan 2018 13:35:05 -0500
T: 0.132 ms
I: plural substring
q: ("VISIO.EXE;Thu, 06 Oct 2016 05:46:33 -0500;Tue, 23 Jan 2018 06:16:23 -0500;Tue, 23 Jan 2018 13:35:05 -0500;TRUE;111 days, 04:31:41.124;422";"WORD.EXE;Thu, 06 Oct 2016 05:46:33 -0500;Tue, 23 Jan 2018 06:16:23 -0500;Tue, 23 Jan 2018 13:35:05 -0500;TRUE;111 days, 04:31:41.124;422") whose (preceding text of first ";" of it as lowercase = "visio.exe" and now - (preceding text of first ";" of following text of first ";" of following text of first ";" of following text of first ";" of it as time) > 90 * day)
T: 0.150 ms
I: plural string
The second method uses regular expressions. When I first started using regular expressions about a year ago I was hesitant and sometimes overwhelmed, but they do make for some very powerful text parsing, and can be a little more easily modified if (for example) the number of fields were to change. Here’s what I ended up with
q: (parenthesized parts 1 of it, parenthesized parts 3 of it) of matches(regex "^([^;]*)(;[^;]*){2};([^;]*);.*$") of ("VISIO.EXE;Thu, 06 Oct 2016 05:46:33 -0500;Tue, 23 Jan 2018 06:16:23 -0500;Tue, 23 Jan 2018 13:35:05 -0500;TRUE;111 days, 04:31:41.124;422";"WORD.EXE;Thu, 06 Oct 2016 05:46:33 -0500;Tue, 23 Jan 2018 06:16:23 -0500;Tue, 23 Jan 2018 13:35:05 -0500;TRUE;111 days, 04:31:41.124;422")
A: VISIO.EXE, ( Tue, 23 Jan 2018 13:35:05 -0500 )
A: WORD.EXE, ( Tue, 23 Jan 2018 13:35:05 -0500 )
T: 0.235 ms
I: plural ( substring, substring )
q: (parenthesized parts 1 of it, parenthesized parts 3 of it) of matches(regex "^([^;]*)(;[^;]*){2};([^;]*);.*$") of ("VISIO.EXE;Thu, 06 Oct 2016 05:46:33 -0500;Tue, 23 Jan 2018 06:16:23 -0500;Tue, 23 Jan 2018 13:35:05 -0500;TRUE;111 days, 04:31:41.124;422";"WORD.EXE;Thu, 06 Oct 2016 05:46:33 -0500;Tue, 23 Jan 2018 06:16:23 -0500;Tue, 23 Jan 2018 13:35:05 -0500;TRUE;111 days, 04:31:41.124;422")
A: VISIO.EXE, ( Tue, 23 Jan 2018 13:35:05 -0500 )
A: WORD.EXE, ( Tue, 23 Jan 2018 13:35:05 -0500 )
T: 0.231 ms
I: plural ( substring, substring )
q: exists (parenthesized parts 1 of it, parenthesized parts 3 of it) whose (item 0 of it as lowercase = "visio.exe" and now - (item 1 of it as time) > 90 * day) of matches(regex "^([^;]*)(;[^;]*){2};([^;]*);.*$") of ("VISIO.EXE;Thu, 06 Oct 2016 05:46:33 -0500;Tue, 23 Jan 2018 06:16:23 -0500;Tue, 23 Jan 2018 13:35:05 -0500;TRUE;111 days, 04:31:41.124;422";"WORD.EXE;Thu, 06 Oct 2016 05:46:33 -0500;Tue, 23 Jan 2018 06:16:23 -0500;Tue, 23 Jan 2018 13:35:05 -0500;TRUE;111 days, 04:31:41.124;422")
A: False
T: 0.267 ms
I: singular boolean
an explanation for the regex "^([^;]*)(;[^;]*){2};([^;]*);.*$"
is in order.
I’m building up three sets of parenthesized matches, so I can refer to them as “parenthesized parts 1”, “parenthesized parts 2”, and “parenthesized parts 3”.
^([^;]*)
--> matches the first field, from the start of the line until the first semicolon.
This is followed by (;[^;]*){2}
--> matches two semicolon-delimited fields - the two time fields that we want to discard.
That’s then followed by ;([^;]*);.*$
. This matches the third dated field and through the rest of the line, keeping only the time/date itself inside the parentheses (discarding the leading and trailing semicolons).