Regexp help

[Josh]

Alright, I am trying to create a regexp that performs the following:

Selects an IP address from a line but only if the line starts with a pre-defined text string. There will be text in between the text string and the IP address -- I want to ignore the entire line except for the IP address. I know this is do-able but it is driving me nuts.

Any ideas?

[Renegade]

^definedstring.+([0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}).+$

Or perhaps:

^definedstring.+([0-9]+\.[0-9]+\.[0-9]+\.[0-9]+).+$

But, that should do it or at least give you enough to test & tweak. You'll have 1 capture group with the IP address.

[Renegade]

This is better:

^definedstring.+([1-9][0-9]{0,2}\.[1-9][0-9]{0,2}\.[1-9][0-9]{0,2}\.[1-9][0-9]{0,2}).+$

[Josh]

So...Here is a single line of what I am trying to filter:

SOME DATE TIME GROUP HERE :: CtrlChan Some more text here [192.192.192.192]

I want to filter out the IP address in any line that contains CtrlChan.

[Josh]

Sample line

2014-10-10 19:28:01.110::ErrorMsg::CtrlChan Error_Decode [192.192.192.192]

If, and only if, the line has CtrlChan in it do I want to extract the IP address from the line. This will be a very large file (200+MB per file) with a large number of different entries.

[Renegade]

That helps.

This works, but you must specify that the search is multiline in order for the ^ and $ to operate properly:

^.+CtrlChan .+[^0-9]([1-9][0-9]{0,2}\.[1-9][0-9]{0,2}\.[1-9][0-9]{0,2}\.[1-9][0-9]{0,2}).+$

Here's the result in Expresso:

[Renegade]

And here's the analysis to help explain what's happening in there:

[4wd]

With a little help from here.

NOTE: It doesn't check if the IP is from a valid range like @Ren's but on the other hand it won't miss any if the IP is invalid.

[Josh]

Renegade and 4wd, I owe you both big time! You both just helped me save a large amount of time by not having to search these files manually. Thanks!

[4wd]

Actually, @Ren's does pick up invalid IPs ... Sorry 

Honestly @Ren, you should have limited the number range it'll match on then I wouldn't have been wrong

[Renegade]

Yeah... generally you can be pretty sloppy when checking for IP addresses though as they're unlikely to be reported badly, and few other strings will match improperly, e.g. version numbering with major, minor, revision, and build -- 10.23.34.987.

Here are some URLs for regex to actually do IP addresses properly:

http://www.shellhack...in-a-File-Using-Grep

http://www.mkyong.co...-regular-expression/

http://stackoverflow...-strings-using-regex

They're kind of ugly with a lot of pipes.

@4wd - Your regex there is elegant and terse. It's one of the things that I tend to avoid as I find it's simply easier to read when being a bit more verbose. I also try to avoid a lot of special matching characters as in general as a lot of the regex I use are in EditPlus, and it's not really the best there, so it encourages being verbose rather than elegant.

[4wd]

@4wd - Your regex there is elegant and terse.

-Renegade (November 04, 2014, 09:25 PM)

The IP bit wasn't mine, it came from here.

It's one of the things that I tend to avoid as I find it's simply easier to read when being a bit more verbose.

Conversely, I find the opposite

I have more chance of understanding it if I'm not going cross-eyed trying to take in 50+ characters at once