Hernan Marcelo Salvarezza wrote:
>
> Hello all, i am parsing a cisco log and i can'nt find the exact
> regexp,following goes the log and the script..
>
> Jul 25 10:39:12 10.0.0.1 852: 1d23h: %VOIPAAA-5-VOIP_CALL_HISTORY:
> CallLegType 2, ConnectionId 0 0 0 0, SetupTime *10:46:49.143 GMT Thu Jul
> 25 2002, PeerAddress 0051122323223, PeerSubAddress , DisconnectCause 0
> , DisconnectText , ConnectTime *10:47:09.753 GMT Thu Jul 25 2002,
> DisconnectTime *10:47:09.753 GMT Thu Jul 25 2002, CallOrigin 1,
> ChargedUnits 0, InfoType 2, TransmitPackets 0, TransmitBytes 0,
> ReceivePackets 358, ReceiveBytes 7064
> .......
>
> my $dtgT = '\d|:|\.';
> my $peer = 'PeerAddress';
> my $upT = 'ConnectTime';
> my $downT = 'DisconnectTime';
> my $prefT = '"0051"';
>
> my $find = qr/$peer\s* ([$prefT](\d+)) .* \s*$upT\s* ([\*$dtgT]+) .*
> \s*$downT\s* ([\*$dtgT]+) .* /xo;
If we interpolate the variables we get:
> qr/PeerAddress\s* (["0051"](\d+)) .*
^^^^^^^^
This character class matches _one_ character that is either '"' or '0'
or '5' or '1' but you don't have a quotation mark (") in the data. You
probably want:
PeerAddress\s* (0051\d+) .*
> \s*ConnectTime\s* ([\*\d|:|\.]+) .*
^^^^^^^^^^^
This character class matches one or more characters that is either '*'
or 0-9 or '|' or ':' or '.' but you don't have a vertical bar (|) in the
data. You probably want:
\s*ConnectTime\s* \*([\d:.]+) .*
> \s*DisconnectTime\s* ([\*\d|:|\.]+) .*/xo;
^
The /o option is not used because when you compile the regular
expression with qr// the variables have already been interpolated.
\s*DisconnectTime\s* \*([\d:.]+) .*/x;
> This works fine and gives me the following output:
> 0051122323223,16:11:29.482,16:11:29.482
>
> Now i need to get the first part of the log(Jul 25 10:39:12) with the
> regexp and print it before the number string
> (0051122323223,16:11:29.482,16:11:29.482),so i use the following regexp
> to do that
>
> my $find = qr/(.*?) (\d+\.\d+\.\d+\.\d+.\d+.\d+)\s* /xo
> it works fine and brings this output:
>
> Jul 23 11:01:45
> Jul 23 11:14:44
> Jul 23 11:14:45
>
> but it does'nt work when i put the two regexps together
>
> my $find = qr/(.*?) (\d+\.\d+\.\d+\.\d+.\d+.\d+)\s* $peer\s*
> ([$prefT](\d+)) .* \s*$upT\s* ([\*$dtgT]+) .* \s*$downT\s* ([\*$dtgT]+)
> ..* /xo;
my $find = qr/(\S+\s+\d+\s+[\d:]+) .*?
\s*$peer\s* (0051\d+) .*?
\s*$upT\s* \*([\d:.]+) .*?
\s*$downT\s* \*([\d:.]+) /x;
John
--
use Perl;
program
fulfillment
--
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]
