LinuxQuestions.org - Parsing The Entries of a BIND log Query file

There are several ways to approach this, though all of them have some degree of similarity. The ultimate key to the problem lies in what are called regular expressions and this would be a good place for you to begin your research. Regular expressions are a pattern matching language and in your particular case you are looking to pattern match an IP address.

The approach that I would take would be to loop through the range of IP addresses, which runs from .1 to .100 (noting that you can use this number range as a loop variable. Then match the pattern of the IP address created based upon this variable to your file and PRINT the desired field (words or items separated by space). The first tool that comes to mind to do this is AWK (thought SED would probably work just as well, effectively acting as an advanced grep). See this page for some basic instructions on how to use AWK, along with some examples at the bottom: http://www.manpagez.com/man/1/awk/

As a starter example:
given tfile below, which would be your log file:

Code:

192.168.2.1 10000

192.168.2.1 20000

192.168.2.1 30000

192.168.2.2 10000

192.168.2.3 10000

192.168.2.5 10000

192.168.2.8 10000

Use a script like this

Code:

#! /bin/bash

for i in {1..10}

do

ipb="192.168.2."

ip=$ipb$i

echo "looking for $ip"

awk -v x=$ip '$1==x { print $2 }' tfile

done

And this gives:

Code:

looking for 192.168.2.1

10000

20000

30000

looking for 192.168.2.2

10000

looking for 192.168.2.3

10000

looking for 192.168.2.4

looking for 192.168.2.5

10000

looking for 192.168.2.6

looking for 192.168.2.7

looking for 192.168.2.8

10000

looking for 192.168.2.9

looking for 192.168.2.10

Note how it parses through the range of IP addresses, matches the lines with that IP address and prints out the desired field.