That would miss the second then because there is no space before "SRC". IMHO (and I am in no way a regular expression expert) you need a more sophisticated expression than ".*". Some that says match any characters _other_ than_ "SRC=". As Michael said, the ".*" matches the longest possible substring. Since you want to process multiple instances of "SRC=<IP address>" you need to qualify it. Eric ----- Original Message ----- From: "Simon Tneoh Chee-Boon (Jaring Dialup)" <tneohcb@xxxxxxxxxxxx> To: "General Red Hat Linux discussion list" <redhat-list@xxxxxxxxxx> Sent: Sunday, May 16, 2004 8:37 AM Subject: Re: SED Help > How about the following with a space in front of SRC? > sed -re 's/.* SRC=([0-9]+\.[0-9]+\.[0-9]+\.[0-9]).*/\1/' > > Regards, > Simon. > -- > Simon Tneoh Chee-Boon Gen-X Technology Sdn. Bhd. > http://www.gen-x.com.my http://www.tneoh.zoneit.com/simon/ > > > ----- Original Message ----- > From: "Mike Vanecek" <rh_list@xxxxxxxxxxxxx> > To: "General Red Hat Linux discussion list" <redhat-list@xxxxxxxxxx> > Sent: Sunday, May 16, 2004 10:27 PM > Subject: Re: SED Help > > > > $ grep -i "`date '+%b %_d'`" packet.test2 | sed -re > > > 's/.*SRC=([0-9]+\.[0-9]+\.[0-9]+\.[0-9]).*/\1/' > > > 66.76.12.5 > > > 66.76.12.5 > > I thought it would pick up the first? If I change the second SRC to SRX, > then > > it does pick up the first one. > > > > What do I need to specify to make it pick up the first one? > > > > -- > redhat-list mailing list > unsubscribe mailto:redhat-list-request@xxxxxxxxxx?subject=unsubscribe > https://www.redhat.com/mailman/listinfo/redhat-list > > -- redhat-list mailing list unsubscribe mailto:redhat-list-request@xxxxxxxxxx?subject=unsubscribe https://www.redhat.com/mailman/listinfo/redhat-list
