Hi to all, i need to retrieve a single ""field" value from the log file of an IIS server, i need to bring only the s-ip field from this log file so i can create nice reports based on origin IP address because this particular web server is accesed by just a handful of possible ip addresses and i need to know how many times it was accesed daily from each ip address, i know i have to do it using a log item but i have no idea what regular expression to use to bring just the "field" i need, the file format is as follows:
#Software: Microsoft Internet Information Services 7.5
#Version: 1.0
#Date: 2011-06-17 12:15:16
#Fields: date time s-sitename s-computername s-ip cs-method cs-uri-stem cs-uri-query s-port cs-username c-ip cs(User-Agent) sc-status sc-substatus sc-win32-status sc-bytes cs-bytes time-taken
2011-06-17 12:15:16 W3SVC1 WEBAPP01 192.168.64.240 GET / - 443 - 192.168.192.40 Mozilla/4.0+(compatible;+MSIE+8.0;+Windows+NT+5.1;+Trident/4.0;+InfoPath.1;+.NET+CLR+2.0.50727;+.NET+CLR+1.1. 4322) 200 0 0 1832 572 468
2011-06-17 12:15:16 W3SVC1 WEBAPP01 192.168.64.240 GET /Silverlight.js - 443 - 192.168.192.40 Mozilla/4.0+(compatible;+MSIE+8.0;+Windows+NT+5.1;+Trident/4.0;+InfoPath.1;+.NET+CLR+2.0.50727;+.NET+CLR+1.1. 4322) 304 0 0 235 552 171
2011-06-17 12:15:16 W3SVC1 WEBAPP01 192.168.64.240 GET /favicon.ico - 443 - 192.168.192.40 Mozilla/4.0+(compatible;+MSIE+8.0;+Windows+NT+5.1;+Trident/4.0;+InfoPath.1;+.NET+CLR+2.0.50727;+.NET+CLR+1.1. 4322) 404 0 2 1430 402 0
2011-06-17 12:15:16 W3SVC1 WEBAPP01 192.168.64.240 GET /ClientBin/index.php - 443 - 192.168.192.40 Mozilla/4.0+(compatible;+MSIE+8.0;+Windows+NT+5.1;+Trident/4.0;+InfoPath.1;+.NET+CLR+2.0.50727;+.NET+CLR+1.1. 4322) 304 0 0 235 501 187
2011-06-17 12:15:19 W3SVC1 WEBAPP01 192.168.64.240 POST /WatchlistService.svc - 443 - 10.209.10.101 Mozilla/4.0+(compatible;+MSIE+7.0;+Windows+NT+5.1) 200 0 0 695 729 717
2011-06-17 12:15:36 W3SVC1 WEBAPP01 192.168.64.240 GET / - 443 - 192.168.192.40 Mozilla/4.0+(compatible;+MSIE+8.0;+Windows+NT+5.1;+Trident/4.0;+.NET+CLR+2.0.50727;+.NET+CLR+1.1.4322;+.NET+C LR+3.0.04506.648;+.NET+CLR+3.5.21022) 200 0 0 1832 708 0
2011-06-17 12:15:36 W3SVC1 WEBAPP01 192.168.64.240 GET /Silverlight.js - 443 - 192.168.192.40 Mozilla/4.0+(compatible;+MSIE+8.0;+Windows+NT+5.1;+Trident/4.0;+.NET+CLR+2.0.50727;+.NET+CLR+1.1.4322;+.NET+C LR+3.0.04506.648;+.NET+CLR+3.5.21022) 200 0 0 3235 496 31
2011-06-17 12:15:37 W3SVC1 WEBAPP01 192.168.64.240 GET /favicon.ico - 443 - 192.168.192.40 Mozilla/4.0+(compatible;+MSIE+8.0;+Windows+NT+5.1;+Trident/4.0;+.NET+CLR+2.0.50727;+.NET+CLR+1.1.4322;+.NET+C LR+3.0.04506.648;+.NET+CLR+3.5.21022) 404 0 2 1430 434 0
Any help would be much appreciated
Thanks in advance
#Software: Microsoft Internet Information Services 7.5
#Version: 1.0
#Date: 2011-06-17 12:15:16
#Fields: date time s-sitename s-computername s-ip cs-method cs-uri-stem cs-uri-query s-port cs-username c-ip cs(User-Agent) sc-status sc-substatus sc-win32-status sc-bytes cs-bytes time-taken
2011-06-17 12:15:16 W3SVC1 WEBAPP01 192.168.64.240 GET / - 443 - 192.168.192.40 Mozilla/4.0+(compatible;+MSIE+8.0;+Windows+NT+5.1;+Trident/4.0;+InfoPath.1;+.NET+CLR+2.0.50727;+.NET+CLR+1.1. 4322) 200 0 0 1832 572 468
2011-06-17 12:15:16 W3SVC1 WEBAPP01 192.168.64.240 GET /Silverlight.js - 443 - 192.168.192.40 Mozilla/4.0+(compatible;+MSIE+8.0;+Windows+NT+5.1;+Trident/4.0;+InfoPath.1;+.NET+CLR+2.0.50727;+.NET+CLR+1.1. 4322) 304 0 0 235 552 171
2011-06-17 12:15:16 W3SVC1 WEBAPP01 192.168.64.240 GET /favicon.ico - 443 - 192.168.192.40 Mozilla/4.0+(compatible;+MSIE+8.0;+Windows+NT+5.1;+Trident/4.0;+InfoPath.1;+.NET+CLR+2.0.50727;+.NET+CLR+1.1. 4322) 404 0 2 1430 402 0
2011-06-17 12:15:16 W3SVC1 WEBAPP01 192.168.64.240 GET /ClientBin/index.php - 443 - 192.168.192.40 Mozilla/4.0+(compatible;+MSIE+8.0;+Windows+NT+5.1;+Trident/4.0;+InfoPath.1;+.NET+CLR+2.0.50727;+.NET+CLR+1.1. 4322) 304 0 0 235 501 187
2011-06-17 12:15:19 W3SVC1 WEBAPP01 192.168.64.240 POST /WatchlistService.svc - 443 - 10.209.10.101 Mozilla/4.0+(compatible;+MSIE+7.0;+Windows+NT+5.1) 200 0 0 695 729 717
2011-06-17 12:15:36 W3SVC1 WEBAPP01 192.168.64.240 GET / - 443 - 192.168.192.40 Mozilla/4.0+(compatible;+MSIE+8.0;+Windows+NT+5.1;+Trident/4.0;+.NET+CLR+2.0.50727;+.NET+CLR+1.1.4322;+.NET+C LR+3.0.04506.648;+.NET+CLR+3.5.21022) 200 0 0 1832 708 0
2011-06-17 12:15:36 W3SVC1 WEBAPP01 192.168.64.240 GET /Silverlight.js - 443 - 192.168.192.40 Mozilla/4.0+(compatible;+MSIE+8.0;+Windows+NT+5.1;+Trident/4.0;+.NET+CLR+2.0.50727;+.NET+CLR+1.1.4322;+.NET+C LR+3.0.04506.648;+.NET+CLR+3.5.21022) 200 0 0 3235 496 31
2011-06-17 12:15:37 W3SVC1 WEBAPP01 192.168.64.240 GET /favicon.ico - 443 - 192.168.192.40 Mozilla/4.0+(compatible;+MSIE+8.0;+Windows+NT+5.1;+Trident/4.0;+.NET+CLR+2.0.50727;+.NET+CLR+1.1.4322;+.NET+C LR+3.0.04506.648;+.NET+CLR+3.5.21022) 404 0 2 1430 434 0
Any help would be much appreciated
Thanks in advance