CODEWITHSUNDEEP
regexnotepad++
Evan
Evan

Reputation: 1713

Count unique ips in log file, with regex

I am trying to match only unique ips on a log file using negative lookahead in regex. The reason for this is because i am trying to do the counting using only notepad ++ :) I cant seem to get it right for some reason though, there are repeating matches. Rerex : (\d*?\.\d*?\.\d*?\.\d*)(?!\1) Part of log:

24.90.247.245 - - [16/May/2014:04:43:37 -0400] "GET /rd/index.shtml HTTP/1.1" 200 263 "-" "-"
132.199.208.13 - - [16/May/2014:04:43:38 -0400] "GET /rd/index.shtml HTTP/1.1" 200 300 "-" "-"
58.152.254.32 - - [16/May/2014:04:43:38 -0400] "GET /rd/index.shtml HTTP/1.1" 200 300 "-" "-"
58.152.254.32 - - [16/May/2014:04:43:38 -0400] "GET /rd/index.shtml HTTP/1.1" 200 300 "-" "-"
134.176.77.200 - - [16/May/2014:04:43:39 -0400] "GET /rd/index.shtml HTTP/1.1" 200 300 "-" "-"
151.97.52.74 - - [16/May/2014:04:43:40 -0400] "GET /rd/index.shtml HTTP/1.1" 200 263 "-" "-"
50.31.10.96 - - [16/May/2014:04:43:40 -0400] "GET /rd/index.shtml HTTP/1.1" 200 244 "-" "-"
223.87.53.36 - - [16/May/2014:04:43:41 -0400] "GET /rd/index.shtml HTTP/1.1" 200 300 "-" "-"
213.202.50.177 - - [16/May/2014:04:43:43 -0400] "GET /rd/index.shtml HTTP/1.1" 200 263 "-" "-"
216.40.65.205 - - [16/May/2014:04:43:43 -0400] "GET /rd/index.shtml HTTP/1.1" 200 263 "-" "-"
147.83.107.157 - - [16/May/2014:04:43:43 -0400] "GET /rd/index.shtml HTTP/1.1" 200 263 "-" "-"
24.92.240.190 - - [16/May/2014:04:43:44 -0400] "GET /rd/index.shtml HTTP/1.1" 200 263 "-" "-"
137.248.75.218 - - [16/May/2014:04:43:45 -0400] "GET /rd/index.shtml HTTP/1.1" 200 263 "-" "-"
147.213.74.167 - - [16/May/2014:04:43:45 -0400] "GET /rd/index.shtml HTTP/1.1" 200 300 "-" "-"
54.226.75.239 - - [16/May/2014:04:43:46 -0400] "GET /rd/index.shtml HTTP/1.1" 200 300 "-" "-"
218.42.9.181 - - [16/May/2014:04:43:46 -0400] "GET /rd/index.shtml HTTP/1.1" 200 300 "-" "-"
150.140.182.17 - - [16/May/2014:04:43:47 -0400] "GET /rd/index.shtml HTTP/1.1" 200 300 "-" "-"
24.213.205.187 - - [16/May/2014:04:43:47 -0400] "GET /rd/index.shtml HTTP/1.1" 200 263 "-" "-"
209.181.139.29 - - [16/May/2014:04:43:47 -0400] "GET /rd/index.shtml HTTP/1.1" 200 263 "-" "-"
183.223.170.34 - - [16/May/2014:04:43:48 -0400] "GET /rd/index.shtml HTTP/1.1" 200 300 "-" "-"
216.59.242.112 - - [16/May/2014:04:43:48 -0400] "GET /rd/index.shtml HTTP/1.1" 200 263 "-" "-"
142.134.234.249 - - [16/May/2014:04:43:48 -0400] "GET /rd/index.shtml HTTP/1.1" 200 263 "-" "-"
130.237.254.155 - - [16/May/2014:04:43:48 -0400] "GET /rd/index.shtml HTTP/1.1" 200 263 "-" "-"
5.254.134.181 - - [16/May/2014:04:43:49 -0400] "GET /rd/index.shtml HTTP/1.1" 200 300 "-" "-"
24.90.247.245 - - [16/May/2014:04:43:49 -0400] "GET /rd/index.shtml HTTP/1.1" 200 263 "-" "-"
128.205.64.53 - - [16/May/2014:04:43:49 -0400] "GET /rd/index.shtml HTTP/1.1" 200 263 "-" "-"

Upvotes: 0

Views: 1582

Answers (1)

Jerry
Jerry

Reputation: 71538

You need to tell the regex that the IP could be anywhere ahead; also meaning there can be a lot of characters between the IP and the next one. Thus, you might want to try this:

(\d*?\.\d*?\.\d*?\.\d*)(?!.*?\1)

And check the . matches newline checkbox as well to make . make line breaks.

Upvotes: 1

Related Questions