get quote enclosed field in a line

Discussion in 'Perl Misc' started by xahlee@gmail.com, Apr 18, 2008.

  1. Guest

    is there a simple way in perl, python, or awk/shell/pipe, that gets
    the user agent field in a apache log?

    e.g. the typical line is like this:

    189.139.109.235 - - [07/Apr/2008:00:00:16 -0400] "GET /
    Periodic_dosage_dir/lacru/manara.html HTTP/1.1" 200 1933 xahlee.org
    "http://xahlee.org/Periodic_dosage_dir/lacru/manara2.html" "Mozilla/
    5.0 (Windows; U; Windows NT 5.1; es-ES; rv:1.8.1.13) Gecko/20080311
    Firefox/2.0.0.13" "-"

    I want the part: "Mozilla/5.0 (Windows; U; Windows NT 5.1; es-ES; rv:
    1.8.1.13) Gecko/20080311 Firefox/2.0.0.13".

    Thanks.

    Xah

    ∑ http://xahlee.org/

    ☄
    , Apr 18, 2008
    #1
    1. Advertising

  2. wrote:
    > is there a simple way in perl, python, or awk/shell/pipe, that gets
    > the user agent field in a apache log?
    >
    > e.g. the typical line is like this:
    >
    > 189.139.109.235 - - [07/Apr/2008:00:00:16 -0400] "GET /
    > Periodic_dosage_dir/lacru/manara.html HTTP/1.1" 200 1933 xahlee.org
    > "http://xahlee.org/Periodic_dosage_dir/lacru/manara2.html" "Mozilla/
    > 5.0 (Windows; U; Windows NT 5.1; es-ES; rv:1.8.1.13) Gecko/20080311
    > Firefox/2.0.0.13" "-"
    >
    > I want the part: "Mozilla/5.0 (Windows; U; Windows NT 5.1; es-ES; rv:
    > 1.8.1.13) Gecko/20080311 Firefox/2.0.0.13".
    >
    > Thanks.
    >
    > Xah
    >
    > ∑ http://xahlee.org/
    >
    > ☄


    Something like:
    # cut -d '"' -f 6 < httpd-access.log
    ?
    --
    mph
    Martin P. Hellwig, Apr 18, 2008
    #2
    1. Advertising

  3. "" <> wrote in news::

    [ Replying only in clpm because I can only talk about Perl ]

    > is there a simple way in perl


    s/perl/Perl ;-)

    > 189.139.109.235 - - [07/Apr/2008:00:00:16 -0400] "GET /
    > Periodic_dosage_dir/lacru/manara.html HTTP/1.1" 200 1933
    > xahlee.org
    > "http://xahlee.org/Periodic_dosage_dir/lacru/manara2.html" "Mozilla/
    > 5.0 (Windows; U; Windows NT 5.1; es-ES; rv:1.8.1.13) Gecko/20080311
    > Firefox/2.0.0.13" "-"
    >
    > I want the part: "Mozilla/5.0 (Windows; U; Windows NT 5.1; es-ES; rv:
    > 1.8.1.13) Gecko/20080311 Firefox/2.0.0.13".


    Simple.

    #!/usr/bin/perl

    use strict;
    use warnings;

    my $line = <<EOL;
    189.139.109.235 - - [07/Apr/2008:00:00:16 -0400] "GET /
    Periodic_dosage_dir/lacru/manara.html HTTP/1.1" 200 1933 xahlee.org
    "http://xahlee.org/Periodic_dosage_dir/lacru/manara2.html" "Mozilla/
    5.0 (Windows; U; Windows NT 5.1; es-ES; rv:1.8.1.13) Gecko/20080311
    Firefox/2.0.0.13" "-"
    EOL

    # deal with any extra spacing and/or
    # line breaks inserted in posting

    $line =~ s/^\s+//;
    $line =~ s/\s+$//;
    $line =~ s/\s+/ /g;


    if ( $line =~ /"([^"]+)" "[^"]+"\z/ ) {
    print "User agent: $1\n";
    }

    __END__

    C:\Temp> lp
    User agent: Mozilla/ 5.0 (Windows; U; Windows NT 5.1; es-ES; rv:1.8.1.13) Gecko/20080311 Firefox/2.0.0.13

    Sinan

    --
    A. Sinan Unur <>
    (remove .invalid and reverse each component for email address)

    comp.lang.perl.misc guidelines on the WWW:
    http://www.rehabitation.com/clpmisc/
    A. Sinan Unur, Apr 18, 2008
    #3
  4. > wrote:
    > > is there a simple way in perl, python, or awk/shell/pipe, that gets
    > > the user agent field in a apache log?


    > Something like:
    > # cut -d '"' -f 6 < httpd-access.log
    > ?
    > --
    > mph


    Doesn't it feel like autosplit mode never gets any run time?

    perl -laF'"' -ne'print $F[5]' access_log
    Skye Shaw!@#$, Apr 18, 2008
    #4
  5. wrote:
    > is there a simple way in perl, python, or awk/shell/pipe, that gets
    > the user agent field in a apache log?
    >
    > e.g. the typical line is like this:
    >
    > 189.139.109.235 - - [07/Apr/2008:00:00:16 -0400] "GET /
    > Periodic_dosage_dir/lacru/manara.html HTTP/1.1" 200 1933 xahlee.org
    > "http://xahlee.org/Periodic_dosage_dir/lacru/manara2.html" "Mozilla/
    > 5.0 (Windows; U; Windows NT 5.1; es-ES; rv:1.8.1.13) Gecko/20080311
    > Firefox/2.0.0.13" "-"
    >
    > I want the part: "Mozilla/5.0 (Windows; U; Windows NT 5.1; es-ES; rv:
    > 1.8.1.13) Gecko/20080311 Firefox/2.0.0.13".
    >
    > Thanks.
    >
    > Xah
    >
    > ∑ http://xahlee.org/
    >
    > ☄


    awk -F\" '{print $6}' httpd-access.log
    awk -F\" 'NF>6{print $6}' httpd-access.log

    --
    Michael Tosch @ hp : com
    Michael Tosch, Apr 18, 2008
    #5
    1. Advertising

Want to reply to this thread or ask your own question?

It takes just 2 minutes to sign up (and it's free!). Just click the sign up button to choose a username and then you can ask your own questions on the forum.
Similar Threads
  1. Replies:
    3
    Views:
    13,202
  2. Stimp
    Replies:
    2
    Views:
    2,257
    Stimp
    Sep 20, 2006
  3. Eric Layman
    Replies:
    3
    Views:
    624
    Rad [Visual C# MVP]
    Apr 14, 2007
  4. Replies:
    7
    Views:
    290
    Michael Tosch
    Apr 18, 2008
  5. Replies:
    6
    Views:
    439
    Stefan Ram
    Jun 15, 2008
Loading...

Share This Page