How do I sed IPs from the exim_mainlog sending to a particular domain?

[linuxMaestro]

I try this
# cat exim_mainlog | grep yourdomain\.com | awk '{print $5}' | sed 's/:.*//;/^*:/d' | sort -n | uniq -c | sort -n

but get output as follows
1 [12.169.127.126]
1 [193.19.83.11]
1 [193.254.226.6]
1 [195.112.71.8]
1 [195.114.128.20]
1 [195.131.52.143]
1 [195.170.224.107]
1 [195.222.142.34]
1 [195.3.96.93]
1 [195.42.76.14]
1 [202.19.227.65]
1 [204.146.55.143]
1 [204.221.210.202]
1 [205.144.60.20]
1 [205.231.144.130]
1 [207.65.96.16]
1 [209.228.33.179]
1 [209.53.236.187]
1 [212.11.24.22]
1 [212.199.58.253]
1 [212.220.100.99]
1 [213.129.120.3]
1 [213.163.128.201]
1 [213.189.198.214]
1 [213.189.198.216]
1 [213.234.228.82]
1 [216.170.204.108]
1 [216.200.145.37]
1 [216.69.192.97]
1 [217.175.156.2]
1 [217.18.104.165]
1 [62.118.249.43]
1 [63.105.24.104]
1 [64.237.105.11]
1 [64.32.208.218]
1 [64.4.44.200]
1 [65.19.167.135]
1 [66.134.166.212]
1 [66.208.2.6]
1 [67.120.245.34]
1 [68.20.169.178]
1 [70.16.69.140]
1 [80.237.7.34]
1 [80.250.164.226]
1 [80.68.0.8]
1 [80.71.160.16]
1 [80.91.172.227]
1 [81.21.224.2]
1 F=<dante@ujsa.com>
1 F=<elena@planetsunbeam.com>
1 F=<job@pixelhead.by>
1 F=<MAILER-DAEMON@gw.pivden.kiev.ua>
1 F=<MAILER-DAEMON@netclub.ru>
1 F=<MAILER-DAEMON@sever.avtomir.ru>
1 F=<MDaemon@mbb.ru>
1 F=<php-general-return-@lists.php.net>
1 F=<postmaster@mx8.rambler.ru>
1 F=<postmaster@n5.umc.com.ua>
1 F=<postmaster@n6.umc.com.ua>
1 F=<rengels@charter.net>
1 F=<spamblocker-challenge@bounce.earthlink.net>
1 F=<tjenkins@plantel.com>
1 MX
1 sender
1 U=0
1 U=507
1 U=postfix
2 [193.193.193.120]
2 [195.112.71.2]
2 [195.3.96.97]
2 [207.44.130.37]
2 [212.17.0.42]
2 [212.44.131.7]
2 [212.48.153.194]
2 [213.24.38.55]
2 [213.247.159.76]
2 [216.148.222.61]
2 [217.23.152.21]
2 [64.65.61.13]
2 [68.167.190.6]
2 F=<abuse@hotmail.com>
2 U=exim
2 U=qmailr
3 [194.204.19.210]
3 [195.19.32.2]
3 [195.3.96.79]
3 [212.248.12.68]
3 [81.176.67.34]
3 F=<MAILER-DAEMON@mx0.rosnet.ru>
3 F=<postmaster@obladm.nso.ru>
4 [195.2.72.69]
4 [212.9.224.1]
4 [64.106.148.190]
5 [195.248.191.65]
6 [64.4.44.150]
12 [195.170.224.30]
12 [217.9.147.42]
27 [217.23.88.17]
27 F=<postmaster@email.sharkemail.net>
58 U=root
63 [195.248.191.68]
439 F=<>

I want it to appear just as
4 64.106.148.190
5 195.248.191.65
6 64.4.44.150
12 195.170.224.30
12 217.9.147.42
27 217.23.88.17
63 195.248.191.68

What would the correct syntax be for that?

Thanks in advance.

 

[iribach]

difficult w/o seying the input, basing on the output
and your code (a good shell-book will produce wonders),
and assumed ] is the last char in input, i try:
(this is an one liner, newline for readability)

sed -ne 's/.*yourdomain\.com.*\([0-9]*[0-9]\)
.*\[\(
[0-9]*[0-9]\.[0-9]*[0-9]\.[0-9]*[0-9]\.[0-9]*[0-9]
\)\]/\1 \2/p' exim_mainlog|sort -nu

in words:
opening exim_mainlog
(sed, awk, sort can do this, no need of cat)
select all lines containing: something
followed by 'yourdomain.com'
followed by something
followed by digits, remember those
followed by something and a [
followed by dot separated 4 groups of digits, remember those
followed by a ]
print + pipe the remembered digits
to a numerical+unique sort

the main Q is: what's after ']' in input.
[0-9]*[0-9] (one or more digit) is equivalent to perl \d+
sed does not support this notation