perl -ne "chomp; my ($ip) = (split q| |,$_)[2]; my $num; if ($ip=~m/\ .(\d+)$/){$num=$1} print qq|$ip\t$num| . `date ` if($num >= 1 && $num <= 2);" fakesquidlog.txt Prints ======== 192.168.1.1 1Fri Apr 29 09:34:49 Central Daylight Time 2011 192.168.1.2 2Fri Apr 29 09:34:49 Central Daylight Time 2011 (Date format explain: I'm on Windows) #### Fake squid log contains: 134135 22 192.168.1.1 XX 200 HTTP foobar.com johnny huh? JUNK 134136 24 192.168.1.2 XX 200 HTTP foobar.com johnny huh? JUNK2 134137 25 192.168.1.3 XX 200 HTTP foobar.com johnny huh? JUNK3