Okay, in this demo we're going to take a quick look at some of the
string functions we just went over and understand how to apply the
methods and functions to this course. I have my variable STR assigned
PYTHON with the spaces around it, and I've highlighted with these
brackets and the print function, so when I run this I see the spaces and
PYTHON string in the results.
We talked about a few different ways of removing those spaces, and
one way we didn't go in to in great detail in the slides, so I want
to kind of talk about in the demo, is to show you the strip method.
By calling the strip method and assigning it back to the STR variable
and printing it, I've now removed all that whitespace on the edges of
the string.
Another method we talked about in the slicing and dicing section
was adding the range to the index so only to display the parts
of the string we're interested in.
So maybe to print the sliced out part, but because I didn't
assign that back to the STR variable,
it's still going to have those spaces for the next time I go to use it.
Now how do I apply all this to a log file we're looking at?
Well,
aligning the log is going to contain all sorts of useful information that we
need to parse out. Most of the time your SIEM will handle this, but if
you're wanting to grab a one‑off file and quickly retrieve some needed
information out of it with a script, here's a quick walkthrough of some of
the functions that can help here.
The split method is another tool in the toolbox we didn't really cover,
so I want to demonstrate using it here in the demo. By calling split
without the parameters, I basically took this log file and broke it
apart by the spaces inside the string and assigned each of those pieces
to the list I called PARTS.
Each of those parts are now indexed, and because of
the uniformity of the log file,
I know index 0 is the date, 1 is the time, and so on as you see
here. Instead of the straight printing of each,
I'm going to go ahead with the format printing and drop the brackets where
I want to include the relevant list item in the output.
As you can see on January 1,
MikeW was able to successfully log in. In the next clip,
we're going to talk about reading multiple lines from the log and being able to
cycle through to pool all successful and, more importantly,
unsuccessful login attempts. To take the slicing a step further, I
can break down the date and rearrange the content into a format I
may be used to. Here we have month,
date, year, and to get into day, month, year format, you'll
require a little bit more manipulation