#!/usr/bin/perl use strict; my @certs; while() { push @certs, /\'([-.\w]+)\'/ if(/added/); } print join("\n", @certs), "\n"; __DATA__ Sep 12 17:30:02 nt-ca-na CA(Domain-CA): Certificate name 'jsmith.2048' added to database. Sep 12 20:09:37 nt-ca-na CA(Domain-CA): Certificate name 'ksmith.2048' added to database. Sep 12 21:25:30 nt-ca-na CA(Domain-CA): Certificate name 'ssmith.2048' added to database.