[nycbug-talk] Regular expressions

[Brian McGonigle]

On Nov 6, 2007, at 1:23 AM, jonathan at kc8onw.net wrote:

> Hello all,
>
> I see to remember there being a way to specify that part of the  
> condition
> you used to create the match is not returned when the regex  
> returns.  I'm
> trying to return just the number from the "length: 40" portion of this
> line.
>
> "IP (tos 0x0, ttl  47, id 52246, offset 0, flags [none], proto: TCP  
> (6),
> length: 40)"
>
> I'm currently using  grep -Eo "length: ([[:digit:]]{2,4})" but that
> includes "length: " in the output.
>
> If someone can give me the right term or concept to search for I'll  
> do the
> legwork I'm just out of ideas on what to search for and didn't see
> anything relevant in the man pages.
>
> Thanks,
> Jonathan Stewart
>
> P.S. There is probably a better way but the main goal of this is to
> monitor bandwidth usage by IP on a pflog device.  I'll probably do  
> most of
> the work in Python I'm just prototyping in the shell right now.
>
>

Pipe it to " perl -pe 's/.*length: (\d+)\).*/$1/g;' " and you'll get  
just the number following "length: " and before the closing ")".
It essentially does a find and replace on the input.

".*length: (\d+)\.*" 		matches the entire input string. The (\d+)  
matches one or more digits  following "length: " and stores it in $1.  
Then it replaces the input with the just the digits following "length:  
" and prints them.