$ echo " 11 SessionOpen c 123.234.56.78 63618 123.234.56.89:80 11 RxURL c /example.php 11 RxHeader c Host: 123.234.56.89 11 RxHeader c User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:22.0) Gecko/20100101 Firefox/22.0 11 RxHeader c Accept-Language: en-US,en;q=0.5 11 RxHeader c Accept-Encoding: gzip, deflate 11 ReqEnd c 1832330560 1372436083.710740089 1372436083.711302519 0.000174284 0.000352383 0.000210047" | perl -ne 'BEGIN { $/="";} print if (/ReqEnd(?:[\sc]+)\d+\s\d+\.\d+\s+\d+\.\d+\s+\d+\.\d+\s+(\d+\.\d+)/ and $1 > 0)'