On Tue, Jan 12, 2016 at 12:32:26PM -0700, James Lay wrote: > Just the IP address, and the last bit...the entire unparsed_version > field. Anyone got a clever script to do something like this? Thank > you. # bro-cut host unparsed_version < software.log should do it. Johanna