150 likes | 328 Views
Grep Examples. Constructing Greps. Find Social Security Numbers in network traffic (if your a crook:) 466 - 90 - 1234 only this number ddd - dd - dddd any SS# with dashes. Constructing Greps. ddd -? dd -? dddd any SS# with or without dashes
E N D
Constructing Greps • Find Social Security Numbers in network traffic (if your a crook:) • 466-90-1234 • only this number • \d\d\d-\d\d-\d\d\d\d • any SS# with dashes
Constructing Greps • \d\d\d-?\d\d-?\d\d\d\d • any SS# with or without dashes • \d\d\d[\W]?\d\d[\W]?\d\d\d\d • any SS# with or without non-alphanumeric • \d{3}[\W]?\d{2}[\W]?\d{4}
Example 2 • Find all Jons • Jon • every capitalized “Jon” • J[oO][nN] • JON,JoN,JOn
Example 2 • ^J[Oo][Nn] • Lines staring with JON, Jon, JOn, JoN • ^J[Oo][Nn]\s • last one AND a space • (don’t want to find Jonathan)
Example 2 • ^J[Oo][Hh]?[Nn]\s • optional H or h adds: • JOHN , JoHn , JOHn , JoHN • JOhN , John , JOhn , JohN • Notice how using if() comparisons quickly becomes a TON of work?
Back References • Refer to sub-strings after the engine has run • the FSM engine remembers more than just the resulting state of a search (true/false) • Really REALLY useful
Back References • () grouping • \1 to \9 or $1 to $9 (depends on environment) • each pair of () encloses text you want to refer back to • From left to right each () gets a number
Example • Replace “fred” with “Fred” but could also work with “freddie” (just 1 input) • f(redd?i?e?) • Replace with: • F$1 or F\1 (depending on environment)
Example • Some places you can use back references in your search pattern! • Finding the word “at” if it was typed 2 times: at at • (at)\s\1 • Saves copy/paste of the (at) for an easier to read regexp
Advanced Example • Some places you can specify a quantity on a back reference! • Finding multiple number codes: • 12–12–45–89–35– • 56– • (\d\d–)+
Back References • Other special references: • $` (backtick: the key to the left of 1) • everything before the match • $’ (single quote or apostrophe) • everything after the match
Back References • $+ • whatever char the last [] matched • $& • the entire string again-- useless • NOTE: Back references can be slow depending on the engine used
OR • The | (pipe) is used like a logical OR • Combine multiple patterns into 1 • Sometimes faster than 2+ separate searches of the text
Example OR • Find: • f(red)|f(rank) • Replaced with: • "F$1" (or “F\1”) • Capitalizes both fred and frank • *depends on engine if \1,\2