The following script is producing output lines like: {192.168.0.0 - - [30/Oct/2006:22:45:06 -0800] "POST /cgi/addpost-6172 HTTP/1.1" 200 2036 mgz: DECHUNK:OK I:4714 O:2036:57pct. "http://www.voy.com/6172/2313.html" "-"}} The input line is the log line, beginning with the IP address, and for some reason the .*"POST substitution is not deleting anything, it seems. #!/bin/bash DROWS=32 DCOLS=5 DSCOLS=110 LINEFILT='^.*"POST /cgi/addpost-\d' LINEPROC='my $fid; s#^.*.POST /cgi/addpost-/##; s#\D.*$##; $_ = int($_/1000)*1000; ' XFERLOG=/var/logs/apache/site.com.xferlog TALLYUP=/usr/bin//tallyup.pl if [ "$#" -gt "0" ]; then $TALLYUP -r $DROWS -s $DSCOLS -c $DCOLS \ -hp 'http://www.voy.com/' -hs '/' $@ -l "$LINEFILT" -d "$LINEPROC" else tail -f $XFERLOG | $TALLYUP -r $DROWS -s $DSCOLS -c $DCOLS \ -hp 'http://www.voy.com/' -hs '/' -l "$LINEFILT" -d "$LINEPROC" fi