If you want to exclude certain blocks you need to keep track where you are in the file
use Modern::Perl;
# this is the list of sections to change
my @sections = qw/ messages secure cron maillog /;
# we put it in a hash for easy lookup
my %sections = map { $_ => 1 } @sections;
# Herein we remember where we are
my $section;
while ( my $line = <DATA> )
{
# Remember the current section
$section = $1
if ( $line =~ m| \[ monitor:// (?: / ( [^/]+ ) )+ \] |x );
# Change the index line if the current section
# is one that interests us
$line =~ s/ index = ([A-Z0-9]+) _ (np|pr) /** index=LINUX_${2}
+/x #<-- you can remove the indent here once you see it works
if defined $sections{ $section };
print $line;
}
__DATA__
[monitor:///var/log/cron]
index=NDNW_np
sourcetype=syslog
[monitor:///var/log/maillog]
index=BSKX_np
sourcetype=syslog
[monitor:///var/log/secure]
index=NDNDK_np
sourcetype=syslog
[monitor:///var/log/spooler]
index=DNWN_np
sourcetype=syslog
[monitor:///var/log/audit/audit.log]
index=XBJB_np
sourcetype=syslog
[monitor:///var/log/messages]
index=JNJSJ_pr
sourcetype=syslog
[monitor:///var/log/cron]
index=NCJG_pr
sourcetype=syslog
[monitor:///var/log/maillog]
index=JE3K_pr
sourcetype=syslog
[monitor:///var/log/secure]
index=NLNDKN_pr
sourcetype=syslog
[monitor:///var/log/spooler]
index=EKJC_pr
sourcetype=syslog
[monitor:///var/log/audit/audit.log]
index=QKNK_pr
sourcetype=syslog
holli
You can lead your users to water, but alas, you cannot drown them.
-
Are you posting in the right place? Check out Where do I post X? to know for sure.
-
Posts may use any of the Perl Monks Approved HTML tags. Currently these include the following:
<code> <a> <b> <big>
<blockquote> <br /> <dd>
<dl> <dt> <em> <font>
<h1> <h2> <h3> <h4>
<h5> <h6> <hr /> <i>
<li> <nbsp> <ol> <p>
<small> <strike> <strong>
<sub> <sup> <table>
<td> <th> <tr> <tt>
<u> <ul>
-
Snippets of code should be wrapped in
<code> tags not
<pre> tags. In fact, <pre>
tags should generally be avoided. If they must
be used, extreme care should be
taken to ensure that their contents do not
have long lines (<70 chars), in order to prevent
horizontal scrolling (and possible janitor
intervention).
-
Want more info? How to link
or How to display code and escape characters
are good places to start.
|