#!/usr/bin/perl use strict; my (@certs,@lines); @lines=; @certs = grep{/'([-.\w]+)'\s+added/,$_=$1}@lines; #just to check map{print"[$_]\n"}@certs; __DATA__ Sep 12 17:30:02 nt-ca-na CA(Domain-CA): Certificate name 'jsmith.2048' added to database. Sep 12 20:09:37 nt-ca-na CA(Domain-CA): Certificate name 'ksmith.2048' not added to database. Sep 12 21:25:30 nt-ca-na CA(Domain-CA): Certificate name 'ssmith.2048' added to database.