in reply to Need advice on PERL
Others have explained how the pattern match itself works, but they forgot to explain how the whole thing is parsed. The =~ pattern match operator binds more tightly than the = assignment operator, so the pattern match happens first. The parentheses on the left side cause the results of the pattern match to be taken in list context, returning a list of the things captured in parentheses during the match. (This is different from what happens in scalar context. Context is very important in Perl.) In this case it's a list of one thing, which looks like an IPv4 address. That list is assigned to a list of variables. In this case it's a list of just one variable, $srcip. If you wanted to get the four numbers out of the dotted quad, you could do it like this:
my (@ipnums) = $whole_event_string =~ /^(\d+)\.(\d+)\.(\d+)\.(\d+)/;
Then the array @ipnums would have four entries in it, one for each of the four numbers in the dotted quad.
Similarly, if you want to capture more information than just the IP address, you could add to your regular expression and parse more fields with something along these lines...
my ($srcip, $user, $timestamp, $request, $result) = $whole_event_str +ing =~ /^(\d+\.\d+\.\d+\.\d+)\s+\S+\s+(\S+)\s+[[](.*?)[]]\s+\"(.*?)\"\s ++(\d+)/;
HTH.HAND. That regular expression may not be exactly right, because I'm not sure of the exact technical specs of the logfile format you're parsing (Is that an IIS log? yuck!), but it illustrates the principle anyway. Also note that if it _is_ an IIS log, or anything else remotely common, there's probably a module on the CPAN for parsing it, although I don't happen to know of a specific module for that, and a quick search didn't turn up anything obvious.
|
|---|