Copy data found in one file to another/new file

Mike Gill

Is there a way to do a find and then copy that found data into another file? I am going thru logs and want to copy all of the destination IP’s to another txt file if possible. I have the first part of the equation done. Here is an example:

Each line in the log file looks similar to this:

date=2021-03-15 time=17:53:03 logid=0000000011 type=traffic subtype=forward level=warning vd=root srcip=10.198.2.197 srcport=59538 srcintf=“port1” dstip=10.249.10.68 dstport=9997 dstintf=“wan1” poluuid=c717af30-5d04-51e8-905a-d1db557fbc46 sessionid=1573070499 proto=6 action=ip-conn policyid=139 policytype=policy appcat=“unscanned” crscore=5 craction=262144 crlevel=low

I want to copy the “dstip=10.249.10.68” (where the IP address can be different for each line) to a new file if possible. The first part I THINK I already have for the find piece:

dstip=(\d+.\d+.\d+.\d+) <-----That piece of the puzzle works fine and it will go line by line, only finding the various destination IP’s (Thank you Alan Kilborn for helping me figure that out in another “Help Wanted” topic)

Is there a way to copy that data to a new file?

Mike Gill

@Mike-Gill Ok I figured this out on my own…LOL!!

I started at the top of the file then went to:

Search–>Mark

Then copied my find formula above into the “Find What” field and clicked on “Mark All” and then clicked on “Copy Marked Text”. After that I was able to copy ALL of the destination IP’s from that log into a new file.

W00T! :-)

guy038

Hello, @mike-gill,

Yeah, that’s the right way ! However, Mike, note that, before the v7.9.1 release, where the Copy Marked Text button was added, we were forced to use a regex S/R to achieve the same goal !

But this way still works nice with last releases ! For instance :

Copy the contents of your .log file in a new tab
Open the Replace dialog ( Ctrl + H )
- SEARCH (?s)^.+?(dstip=.+?)(?=\x20)|.+
- REPLACE \1\r\n
- Tick the Wrap around option
- Select the Regular expression search mode
- Click on the Replace All button
Save these modified contents

Et voilà !

Best Regards,

guy038