get quote enclosed field in a line

is there a simple way in perl, python, or awk/shell/pipe, that gets
the user agent field in a apache log?

e.g. the typical line is like this:

189.139.109.235 - - [07/Apr/2008:00:00:16 -0400] "GET /
Periodic_dosage_dir/lacru/manara.html HTTP/1.1" 200 1933 xahlee.org
"http://xahlee.org/Periodic_dosage_dir/lacru/manara2.html" "Mozilla/
5.0 (Windows; U; Windows NT 5.1; es-ES; rv:1.8.1.13) Gecko/20080311
Firefox/2.0.0.13" "-"

I want the part: "Mozilla/5.0 (Windows; U; Windows NT 5.1; es-ES; rv:
1.8.1.13) Gecko/20080311 Firefox/2.0.0.13".

Thanks.

Xah
xah@xahlee.org
âˆ=91 http://xahlee.org/

â˜=84

Re: get quote enclosed field in a line

xahlee@gmail.com wrote:
> is there a simple way in perl, python, or awk/shell/pipe, that gets
> the user agent field in a apache log?
>
> e.g. the typical line is like this:
>
> 189.139.109.235 - - [07/Apr/2008:00:00:16 -0400] "GET /
> Periodic_dosage_dir/lacru/manara.html HTTP/1.1" 200 1933 xahlee.org
> "http://xahlee.org/Periodic_dosage_dir/lacru/manara2.html" "Mozilla/
> 5.0 (Windows; U; Windows NT 5.1; es-ES; rv:1.8.1.13) Gecko/20080311
> Firefox/2.0.0.13" "-"
>
> I want the part: "Mozilla/5.0 (Windows; U; Windows NT 5.1; es-ES; rv:
> 1.8.1.13) Gecko/20080311 Firefox/2.0.0.13".
>
> Thanks.
>
> Xah
> xah@xahlee.org
> ∑ http://xahlee.org/
>
> ☄

Something like:
# cut -d '"' -f 6 < httpd-access.log
?
--
mph

Re: get quote enclosed field in a line

"xahlee@gmail.com" wrote in news:c4c50034-2f90-42ce-82ca-8ba214d49ec9@d1g2000hsg.googleg roups.com:

[ Replying only in clpm because I can only talk about Perl ]

> is there a simple way in perl

s/perl/Perl ;-)

> 189.139.109.235 - - [07/Apr/2008:00:00:16 -0400] "GET /
> Periodic_dosage_dir/lacru/manara.html HTTP/1.1" 200 1933
> xahlee.org
> "http://xahlee.org/Periodic_dosage_dir/lacru/manara2.html" "Mozilla/
> 5.0 (Windows; U; Windows NT 5.1; es-ES; rv:1.8.1.13) Gecko/20080311
> Firefox/2.0.0.13" "-"
>
> I want the part: "Mozilla/5.0 (Windows; U; Windows NT 5.1; es-ES; rv:
> 1.8.1.13) Gecko/20080311 Firefox/2.0.0.13".

Simple.

#!/usr/bin/perl

use strict;
use warnings;

my $line = < 189.139.109.235 - - [07/Apr/2008:00:00:16 -0400] "GET /
Periodic_dosage_dir/lacru/manara.html HTTP/1.1" 200 1933 xahlee.org
"http://xahlee.org/Periodic_dosage_dir/lacru/manara2.html" "Mozilla/
5.0 (Windows; U; Windows NT 5.1; es-ES; rv:1.8.1.13) Gecko/20080311
Firefox/2.0.0.13" "-"
EOL

# deal with any extra spacing and/or
# line breaks inserted in posting

$line =~ s/^\s+//;
$line =~ s/\s+$//;
$line =~ s/\s+/ /g;


if ( $line =~ /"([^"]+)" "[^"]+"\z/ ) {
print "User agent: $1\n";
}

__END__

C:\Temp> lp
User agent: Mozilla/ 5.0 (Windows; U; Windows NT 5.1; es-ES; rv:1.8.1.13) Gecko/20080311 Firefox/2.0.0.13

Sinan

--
A. Sinan Unur <1usa@llenroc.ude.invalid>
(remove .invalid and reverse each component for email address)

comp.lang.perl.misc guidelines on the WWW:
http://www.rehabitation.com/clpmisc/

Re: get quote enclosed field in a line

> xah...@gmail.com wrote:
> > is there a simple way in perl, python, or awk/shell/pipe, that gets
> > the user agent field in a apache log?

> Something like:
> # cut -d '"' -f 6 < httpd-access.log
> ?
> --
> mph

Doesn't it feel like autosplit mode never gets any run time?

perl -laF'"' -ne'print $F[5]' access_log

Re: get quote enclosed field in a line

xahlee@gmail.com wrote:
> is there a simple way in perl, python, or awk/shell/pipe, that gets
> the user agent field in a apache log?
>
> e.g. the typical line is like this:
>
> 189.139.109.235 - - [07/Apr/2008:00:00:16 -0400] "GET /
> Periodic_dosage_dir/lacru/manara.html HTTP/1.1" 200 1933 xahlee.org
> "http://xahlee.org/Periodic_dosage_dir/lacru/manara2.html" "Mozilla/
> 5.0 (Windows; U; Windows NT 5.1; es-ES; rv:1.8.1.13) Gecko/20080311
> Firefox/2.0.0.13" "-"
>
> I want the part: "Mozilla/5.0 (Windows; U; Windows NT 5.1; es-ES; rv:
> 1.8.1.13) Gecko/20080311 Firefox/2.0.0.13".
>
> Thanks.
>
> Xah
> xah@xahlee.org
> ∑ http://xahlee.org/
>
> ☄

awk -F\" '{print $6}' httpd-access.log
awk -F\" 'NF>6{print $6}' httpd-access.log

--
Michael Tosch @ hp : com