如何过滤secure日志的IP字段

dolinux

都是牛人啊，我把大家的总结了一下，有些做了一点修改。这里共有12种方法：
1》grep -P -o "(?<=rhost=)\d+.+" | awk '{print $1}' | sort -u
2》sed 's/.*=\([0-9]\{1,3\}[.][0-9]\{1,3\}[.][0-9]\{1,3\}[.][0-9]\{1,3\}\).*/\1/' | sort -u
3》sed -n 's/.*rhost=\([0-9.]\+\).*/\1/p' file2|sort -u
4》sed -n 's/\(.*rhost\)=\(.*\)/\2/p' file2 | awk '{print $1}' | sort -u
5》sed -n 's/.*rhost=\(\([0-9]\+\.\)\{3\}[0-9]\+\).*/\1/p' file2|sort -u
6》egrep -o '[0-9]+\.[0-9.]+' file2|sort -u
7》grep -P -o "(?<=rhost=)\d+[^\s]+\.\d+" file2 |sort -u
8》awk '!a[$14]++{print $14|"sed 's/rhost\=//g'"}' file2
9》awk -F'=| ' 'NF == 20{print $NF}NF == 22{print $(NF-2)}' file2 | sort -u
10》grep -Eo '[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+' file2 | sort -u
11》awk 'BEGIN{FS="rhost="}{print $2}' file2|cut -d " " -f1|sort -u
12》perl -lne '$h{$1}++if/rhost=([\d.]+)/;END{print join"\n",keys(%h)}' file2