sam_111661
Apr 17, 2009Nimbostratus
findstr
Suppose I have data that contains the following:
randomcharacetrs... str=mystring1 str=mystring2 randomcharacetrs...
Is there a way I could store mystring1 and mystring2 ...
when RULE_INIT {
set ::sample_input_string {ldap:attr:attr1 value1 ldap:attr:attr2 value21 ldap:attr:attr2 value22 ldap:attr:attr3 value3 .... etc}
log local0. "Sample input string: $::sample_input_string"
Get the "attribute attribute_value" from the original string
set ::matches [regexp -inline -all {ldap:attr:attr2\s[^\s]+} $::sample_input_string]
log local0. "\$::matches: $::matches"
Loop through each list item and parse the value
foreach ::str $::matches {
log local0. "\$::str=$::str, value=[lindex $::str 1]"
}
}
Rule : Sample input string: ldap:attr:attr1 value1 ldap:attr:attr2 value21 ldap:attr:attr2 value22 ldap:attr:attr3 value3 .... etc
Rule : $::matches: {ldap:attr:attr2 value21} {ldap:attr:attr2 value22}
Rule : $::str=ldap:attr:attr2 value21, value=value21
Rule : $::str=ldap:attr:attr2 value22, value=value22
Aaron