Others have explained how the pattern match itself works, but they forgot to explain how the whole thing is parsed. The =~ pattern match operator binds more tightly than the = assignment operator, so the pattern match happens first. The parentheses on the left side cause the results of the pattern match to be taken in list context, returning a list of the things captured in parentheses during the match. (This is different from what happens in scalar context. Context is very important in Perl.) In this case it's a list of one thing, which looks like an IPv4 address. That list is assigned to a list of variables. In this case it's a list of just one variable, $srcip. If you wanted to get the four numbers out of the dotted quad, you could do it like this:

my (@ipnums) = $whole_event_string =~ /^(\d+)\.(\d+)\.(\d+)\.(\d+)/;

Then the array @ipnums would have four entries in it, one for each of the four numbers in the dotted quad.

Similarly, if you want to capture more information than just the IP address, you could add to your regular expression and parse more fields with something along these lines...

my ($srcip, $user, $timestamp, $request, $result) = $whole_event_str +ing =~ /^(\d+\.\d+\.\d+\.\d+)\s+\S+\s+(\S+)\s+[[](.*?)[]]\s+\"(.*?)\"\s ++(\d+)/;

HTH.HAND. That regular expression may not be exactly right, because I'm not sure of the exact technical specs of the logfile format you're parsing (Is that an IIS log? yuck!), but it illustrates the principle anyway. Also note that if it _is_ an IIS log, or anything else remotely common, there's probably a module on the CPAN for parsing it, although I don't happen to know of a specific module for that, and a quick search didn't turn up anything obvious.


Sanity? Oh, yeah, I've got all kinds of sanity. In fact, I've developed whole new kinds of sanity. You can just call me "Mister Sanity". Why, I've got so much sanity it's driving me crazy.

In reply to Re: Need advice on PERL by jonadab
in thread Need advice on PERL by ccrash

Title:
Use:  <p> text here (a paragraph) </p>
and:  <code> code here </code>
to format your post, it's "PerlMonks-approved HTML":



  • Posts are HTML formatted. Put <p> </p> tags around your paragraphs. Put <code> </code> tags around your code and data!
  • Titles consisting of a single word are discouraged, and in most cases are disallowed outright.
  • Read Where should I post X? if you're not absolutely sure you're posting in the right place.
  • Please read these before you post! —
  • Posts may use any of the Perl Monks Approved HTML tags:
    a, abbr, b, big, blockquote, br, caption, center, col, colgroup, dd, del, details, div, dl, dt, em, font, h1, h2, h3, h4, h5, h6, hr, i, ins, li, ol, p, pre, readmore, small, span, spoiler, strike, strong, sub, summary, sup, table, tbody, td, tfoot, th, thead, tr, tt, u, ul, wbr
  • You may need to use entities for some characters, as follows. (Exception: Within code tags, you can put the characters literally.)
            For:     Use:
    & &amp;
    < &lt;
    > &gt;
    [ &#91;
    ] &#93;
  • Link using PerlMonks shortcuts! What shortcuts can I use for linking?
  • See Writeup Formatting Tips and other pages linked from there for more info.