Forum Discussion
Nimbostratusdouble whitespace as terminator in "findstr"
Hi All(long time lurker, first time poster)
Sorry if this has been addressed but is there a way to use two whitespaces as the terminator in a findstr.
Eg. To extract 123456 from: "...Header1 1wr2s34d5h6 Header2 789 :10 Header3..."
The following seems to work, [findstr $variable Header1 7 He]
however I need to use the double whitespace as the demiliter as it possible that "He" could appear in the text that follows Header1 which would cut the text short) and actual header name that follows header doesn't can also change.
I have tried using a single whitespace as the delimiter which terminates on hte first single whispace:
[findstr $variable Header1 7 { }] = "1wr2s34d5h6 Header2 789"
Adding a second space between the braces doesn't work and simply returns everything up to the end of the string (as does using {" "}.
Any ideas would be much appreciated.
Cheers
Chad
10 Replies
koheed_51878Sorry the third line was meant to say:
Eg. To extract 1wr2s34d5h6 from: "...Header1 1wr2s34d5h6 Header2 789 :10 Header3..."
- Kevin_Stewart
Employee
Have you tried:[findstr $variable "Header1 " 8 " "] - koheed_51878
Hi Kevin
Thanks for the suggestion it looks like that doesn't seem to catch it either.
- nitassThanks for the suggestion it looks like that doesn't seem to catch it either.it seems working here.
e.g.[root@ve11a:Active:Changes Pending] config tmsh list ltm rule myrule ltm rule myrule { when RULE_INIT { set test "Header1 1wr2s34d5h6 Header2 789 :10 Header3" log local0. $test log local0. "\[findstr $test Header1 8 \" \"\] [findstr $test Header1 8 " "]" } } [root@ve11a:Active:Changes Pending] config tail -f /var/log/ltm Jul 16 04:56:02 ve11a info tmm1[8160]: Rule /Common/myrule : Header1 1wr2s34d5h6 Header2 789 :10 Header3 Jul 16 04:56:02 ve11a info tmm1[8160]: Rule /Common/myrule : [findstr Header1 1wr2s34d5h6 Header2 789 :10 Header3 Header1 8 " "] 1wr2s34d5h6 - Kevin_StewartAre you sure it's white space and not perhaps line feeds (ex. "\r\n\r\n")?
- koheed_51878
Thanks nitass. I get the same result when I run your rule however when I substitute my actual headers it does seem to work.
The one that is failing is doing the findstr on an SSL::payload. I tried setting a variable as the SSL::payload and then running the findstr on that with no luck.
Strangely enough if I set a variable as the actual payload text it works.
- nitassI get the same result when I run your rule however when I substitute my actual headers it does seem to work.can you post the irule?
- koheed_51878when CLIENTSSL_HANDSHAKE {
SSL::collect
}
when CLIENTSSL_DATA {
set thepayload [SSL::payload]
set user [findstr $thepayload Authorization 21 {" "}]
log local0. $user
SSL::release
SSL::collect
} - koheed_51878
I tried "\r\n" and it work perfectly. Thanks Kevin, this one was really bugging me.
- Kevin_StewartWell that makes sense. When you collect the payload it looks like a single line of data,
ex.
GET / HTTP/1.1 Host: myhost.com Accept: *.* Authorization: Negotiate blahblah Header1: value1 Header2: value2...
What you don't see is the new line characters that are separating the method line and headers, which actually looks like this:
GET / HTTP/1.1\r\n
Host: myhost.com\r\n
Accept: *.*\r\n
Authorization: Negotiate blahblah\r\n
Header1: value1\r\n
Header2: value2\r\n
...
