«

You just saved me some more stress John. Thanks !
This (\w+)\s+(\d+) did the trick.

Can you pls elaborate on the difference between including stuff in brackets
or not?
Is it always in brackets except for SPACE searches?



"John Bokma" <> wrote in message
news:3f560b30$0$184$...
> Troll wrote:
>
> > OK, I had some luck getting the first value incremented but no more.
> >
> > Version which works:
> > *****************
> > if (/tcp/) {
> > my($Proto)=
> > /^(\w+)/;
> > $Protos{$Proto}++;
> > }
> > print "TCP = $Protos{'tcp'}\n";
> >
> > #output section
> > TCP = 6 # all is correct here
> >
> >
> > Version which does not work:
> > **********************
> > if (/tcp/) {
> > my($Proto, $RecvQ)=
> > /^(\w+) (\s+)/;
> > $Protos{$Proto}++;
> > $RecvQs{$RecvQ)++;
> > }
> > print "TCP = $Protos{'tcp'}\n";
> > print "RecvQ = $RecvQs{'0'}\n";
> >
> > #output section
> > TCP = 6 # all is correct here
> > Use of uninitialized value in concatenation (.) or string at... #
error
> > time - this refers to the 2nd print statement
> > RecvQ = # this is blank
> >
> > I have tried reading the second parameter as a (\s+) and as a (\d+) with
no
> > luck. If you run netstat you will probably see that all items in the
RecvQ
> > column are 0.
> > What have I done wrong now?
>
> I guess you want (\S+) ie, non-whitespace. If it are always digits you
> should use (\d+). If the number of spaces between proto and recvq can be
> more than one you should use something like:
>
> (\w+)\s+(\d+)
>
> print the values of $proto and $recvq
>
> Also, you can't be sure there are any recvqs{'0'} so check this
> same for protos.
>
> print "TCP = ...." if defined $Protos{'tcp'};
> print "RecvQ = ..." if defined $RecvQs{'0'};
>
> > Can a number of whitespaces be represented by:
> > /^(\w+) (\s+)/; # this is a word followed by some spaces followed by a
> > string
>
> nope. \s+ means one or more whitespaces. Not *string*
> and it is a word followed by exactly one space (white space?).
> See above.
>
> HTH
>
> --
> Kind regards, feel free to mail: mail(at)johnbokma.com (or reply)
> virtual home: http://johnbokma.com/ ICQ: 218175426
> John web site hints: http://johnbokma.com/websitedesign/
>

Troll wrote:

> Looks like I had some typos there but after correcting them it's still a no
> go
> /^(\w+) (\s+)/;
> was changed to
> /^(\w+)(\s+)(\S+)(\s+)(\S+)/;
> # looking for word(s), 1 or more spaces, non-space(s), space(s),
> non-space(s)
>
>
> Still get the same output tho:
> #output section
> TCP = 6 # all is correct here
> Use of uninitialized value in concatenation (.) or string at... # error
> time - this refers to the 2nd print statement
> RecvQ = # this is blank
>
> What am I missing?

post a valid line.


--
Kind regards, feel free to mail: mail(at)johnbokma.com (or reply)
virtual home: http://johnbokma.com/ ICQ: 218175426
John web site hints: http://johnbokma.com/websitedesign/

Troll wrote:

> OK, I had some luck getting the first value incremented but no more.
>
> Version which works:
> *****************
> if (/tcp/) {
> my($Proto)=
> /^(\w+)/;
> $Protos{$Proto}++;
> }
> print "TCP = $Protos{'tcp'}\n";
>
> #output section
> TCP = 6 # all is correct here
>
>
> Version which does not work:
> **********************
> if (/tcp/) {
> my($Proto, $RecvQ)=
> /^(\w+) (\s+)/;

The above re says find and extract a word into $Proto, find some
whitepsace and ignore it, then find more whitepsace and extract it into
$RecvQ. Do you mean to use an uypper-case S, meaning find non-whitepsace..?

> $Protos{$Proto}++;
> $RecvQs{$RecvQ)++;
> }
> print "TCP = $Protos{'tcp'}\n";
> print "RecvQ = $RecvQs{'0'}\n";
>
> #output section
> TCP = 6 # all is correct here
> Use of uninitialized value in concatenation (.) or string at... # error
> time - this refers to the 2nd print statement
> RecvQ = # this is blank
>
> I have tried reading the second parameter as a (\s+) and as a (\d+) with no
> luck. If you run netstat you will probably see that all items in the RecvQ
> column are 0.
> What have I done wrong now?
>

If you are trying to parse this:

Proto Recv-Q Send-Q Local Address Foreign Address State
tcp 0 0 redhat:ssh winxp:1099 ESTABLISHED

how about this:

my ($proto,$rxQ,$txQ,$l_addr,$r_addr,$state) =
/^(\w+) (\d+) (\d+) (\S+) (\S+) (\w+)/;

which says (with whitespace in between each):

find a word and extract into $proto,
find a number and extract into $rxQ,
ditto for $txQ,
find NON-whitespace and extract into $l_addr,
ditto for $r_addr,
find a word and extract into $state.

Use \S+ for the addresses because they contain numbers, letters, and a
colon. Neither \w nor \d would match these.

> Can a number of whitespaces be represented by:
> /^(\w+) (\s+)/; # this is a word followed by some spaces followed by a
> string
> or is the above only ONE whitespace?

\s (lower-case) DOES NOT mean a string, it means whitespace.
\S (upper-case) means non-whitespace.

If you have access to "The Camel Book" by ORA, try reading the section
on pattern matching. It's clear you're not getting how to construct a
meaningful regular expression.

Ga Mu wrote:
> If you are trying to parse this:
>
> Proto Recv-Q Send-Q Local Address Foreign Address State
> tcp 0 0 redhat:ssh winxp:1099 ESTABLISHED
>
> how about this:
>
> my ($proto,$rxQ,$txQ,$l_addr,$r_addr,$state) =
> /^(\w+) (\d+) (\d+) (\S+) (\S+) (\w+)/;
>

WHOOPS!

That re should have been:

/^(\w+) +(\d+) +(\d+) +(\S+) +(\S+) +(\w+)/

I just tested it and it works (my Linux box is back up).

Alternatively, you could use "\s+" instead of " +". The former means
one or more whitespace characters (space, tab, newline) , the latter (I
think) means find one or more space characters only (no tab or newline).

> which says (with whitespace in between each):
>
> find a word and extract into $proto,
> find a number and extract into $rxQ,
> ditto for $txQ,
> find NON-whitespace and extract into $l_addr,
> ditto for $r_addr,
> find a word and extract into $state.
>

Greg,
Your last bit made me laugh cause it is exactly how I feel. Still need a lot
of work to understand regexes.
But thanks to the last posts from yourself and John and 2 links I found,
this is much clearer now.

My apologies to both of you for being such a pain


"Ga Mu" <> wrote in message
news:%ao5b.342052$YN5.233647@sccrnsc01...
> Troll wrote:
>
> > OK, I had some luck getting the first value incremented but no more.
> >
> > Version which works:
> > *****************
> > if (/tcp/) {
> > my($Proto)=
> > /^(\w+)/;
> > $Protos{$Proto}++;
> > }
> > print "TCP = $Protos{'tcp'}\n";
> >
> > #output section
> > TCP = 6 # all is correct here
> >
> >
> > Version which does not work:
> > **********************
> > if (/tcp/) {
> > my($Proto, $RecvQ)=
> > /^(\w+) (\s+)/;
>
> The above re says find and extract a word into $Proto, find some
> whitepsace and ignore it, then find more whitepsace and extract it into
> $RecvQ. Do you mean to use an uypper-case S, meaning find
non-whitepsace..?
>
> > $Protos{$Proto}++;
> > $RecvQs{$RecvQ)++;
> > }
> > print "TCP = $Protos{'tcp'}\n";
> > print "RecvQ = $RecvQs{'0'}\n";
> >
> > #output section
> > TCP = 6 # all is correct here
> > Use of uninitialized value in concatenation (.) or string at... #
error
> > time - this refers to the 2nd print statement
> > RecvQ = # this is blank
> >
> > I have tried reading the second parameter as a (\s+) and as a (\d+) with
no
> > luck. If you run netstat you will probably see that all items in the
RecvQ
> > column are 0.
> > What have I done wrong now?
> >
>
> If you are trying to parse this:
>
> Proto Recv-Q Send-Q Local Address Foreign Address State
> tcp 0 0 redhat:ssh winxp:1099 ESTABLISHED
>
> how about this:
>
> my ($proto,$rxQ,$txQ,$l_addr,$r_addr,$state) =
> /^(\w+) (\d+) (\d+) (\S+) (\S+) (\w+)/;
>
> which says (with whitespace in between each):
>
> find a word and extract into $proto,
> find a number and extract into $rxQ,
> ditto for $txQ,
> find NON-whitespace and extract into $l_addr,
> ditto for $r_addr,
> find a word and extract into $state.
>
> Use \S+ for the addresses because they contain numbers, letters, and a
> colon. Neither \w nor \d would match these.
>
> > Can a number of whitespaces be represented by:
> > /^(\w+) (\s+)/; # this is a word followed by some spaces followed by a
> > string
> > or is the above only ONE whitespace?
>
> \s (lower-case) DOES NOT mean a string, it means whitespace.
> \S (upper-case) means non-whitespace.
>
> If you have access to "The Camel Book" by ORA, try reading the section
> on pattern matching. It's clear you're not getting how to construct a
> meaningful regular expression.
>
>
>
>

Mine was failing somewhere on the 4th parameter search ie. the first (\S+)
but that's because I was trying to do:
print "Dells = $LocalAddresses{'Dell'}\n;
whereas there was no value of Dell being passed anywhere - there was only
Dell:smtp and Dell:32769...DOH...


Also, what's the purpose of having something like this at the beginning of
the script:
my (%protos,%rxQs,%txQs,%l_addrs,%r_addrs,%states)
cause when I remarked it with # there was no diff to the way the script
runs.

Troll wrote:

> Will do - thanks.
> I came across the
> use strict
> before [looking at other ppls script examples] but never got the chance to
> read up on it yet.
>
> On a TO DO list now...

put it on *top* of the list. Speaking of top: don't top post and snip
things no longer relevant.

--
Kind regards, feel free to mail: mail(at)johnbokma.com (or reply)
virtual home: http://johnbokma.com/ ICQ: 218175426
John web site hints: http://johnbokma.com/websitedesign/

Sorry. I tried to improve the visibility a bit as the thread was scrolling
but I see you point.
A NG etiquette refresher needed...
Will keep things in order now and *snip* [what does that stand for?] them
when necessary


"John Bokma" <> wrote in message
news:3f561b8f$0$203$...
> Troll wrote:
>
> > Will do - thanks.
> > I came across the
> > use strict
> > before [looking at other ppls script examples] but never got the chance
to
> > read up on it yet.
> >
> > On a TO DO list now...
>
> put it on *top* of the list. Speaking of top: don't top post and snip
> things no longer relevant.
>
> --
> Kind regards, feel free to mail: mail(at)johnbokma.com (or reply)
> virtual home: http://johnbokma.com/ ICQ: 218175426
> John web site hints: http://johnbokma.com/websitedesign/
>

Troll wrote:

> Sorry. I tried to improve the visibility a bit as the thread was scrolling
> but I see you point.
> A NG etiquette refresher needed...
> Will keep things in order now and *snip* [what does that stand for?] them
> when necessary

cut. It is quite common when a large part is removed to state what was
removed, e.g.:

[cut perl example]

or

[snip perl example]

Sometimes <> is used instead of []. Or even ...

Most newsreaders provide scrolling by pressing the space bar. Reading a
top post and scrolling down to understand to what it is referring (and
back up and down etc) is always harder than reading bottom down. Most
postings fit on a screen after careful cutting.

--
Kind regards, feel free to mail: mail(at)johnbokma.com (or reply)
virtual home: http://johnbokma.com/ ICQ: 218175426
John web site hints: http://johnbokma.com/websitedesign/

John and Greg,
Thanks for the help today [again].

I'm sure to have some more Qs tomorrow but right now I need to rewrite the
code from my laptop to an external Solaris box. This will also mean my
variable definions will change. This little task will take me some time
especially that the vi editor I have to use is a less friendly version than
the one which comes with my RH9. I then need to test the code on the
external system so I don't see myself posting anymore today until same time
tomorrow.

Cheers,
T



"John Bokma" <> wrote in message
news:3f5622c2$0$203$...
> Troll wrote:
>
> > Sorry. I tried to improve the visibility a bit as the thread was
scrolling
> > but I see you point.
> > A NG etiquette refresher needed...
> > Will keep things in order now and *snip* [what does that stand for?]
them
> > when necessary
>
> cut. It is quite common when a large part is removed to state what was
> removed, e.g.:
>
> [cut perl example]
>
> or
>
> [snip perl example]
>
> Sometimes <> is used instead of []. Or even ...
>
> Most newsreaders provide scrolling by pressing the space bar. Reading a
> top post and scrolling down to understand to what it is referring (and
> back up and down etc) is always harder than reading bottom down. Most
> postings fit on a screen after careful cutting.
>
> --
> Kind regards, feel free to mail: mail(at)johnbokma.com (or reply)
> virtual home: http://johnbokma.com/ ICQ: 218175426
> John web site hints: http://johnbokma.com/websitedesign/
>