[SOLVED] Problem extracting date

battles · 09-10-2014, 02:20 PM

I have this iptables record:

0 0 DROP all -- * * 61.4.83.186 0.0.0.0/0 /* CN SSH 7 Sep 10 2014 */

and I need to extract the 'Sep 10 2014' date using grep or sed. The date could be like this also: 'Sep 9 2014'. The date I need to get may not be in the same exact position, so I can't use cut. I need something like:

grep -o '[A-Z]\{1,3\} [0-9]\{1,2\} [0-9]\{1,4\}'

that will search and extract it. I can't get it to work.

Thanks.

TB0ne · 09-10-2014, 03:01 PM

Quote:

Originally Posted by battles

I have this iptables record:

0 0 DROP all -- * * 61.4.83.186 0.0.0.0/0 /* CN SSH 7 Sep 10 2014 */

and I need to extract the 'Sep 10 2014' date using grep or sed. The date could be like this also: 'Sep 9 2014'. The date I need to get may not be in the same exact position, so I can't use cut. I need something like:

grep -o '[A-Z]\{1,3\} [0-9]\{1,2\} [0-9]\{1,4\}'

that will search and extract it. I can't get it to work.

Thanks.

Why not use awk, and set the field-delimiter to be the space/tab character?

Code:

awk -F " " '{print $14" "$15" "$16}'

..will do it, and return "Sep 10 2014". You can also use sed, and rip out everything from beginning of line to the SSH, and manipulate it from there:

Code:

sed -n 's/.*SSH //p' <filename>

...which returns "7 Sep 10 2014 */", and is easier to manipulate from there.

battles · 09-10-2014, 03:05 PM

Thanks. When I see awk, I tend to need some kind of stiff drink. I have tried to work with awk, but have always failed. I'll use your example, however.

norobro · 09-10-2014, 03:40 PM

grep works for me using the -P switch, removing the backslashes in the regex and adding a-z for the lower case letters:

Code:

grep -o  -P '[A-Za-z]{1,3} [0-9]{1,2} [0-9]{1,4}'

battles · 09-10-2014, 03:47 PM

Quote:

Originally Posted by norobro

grep works for me using the -P switch, removing the backslashes in the regex and adding a-z for the lower case letters:

Code:

grep -o  -P '[A-Za-z]{1,3} [0-9]{1,2} [0-9]{1,4}'

Yes, that is exactly what I needed! My problem is that the 'CN' in my record example above can go missing for some reason, so I needed to go after the date your way. I could have counted the columns and determined what to use for the awk -F " " '{print $14" "$15" "$16}' method, but the grep takes care of that. I didn't have a grep -P example, so I couldn't figure it out.

Thanks.