I am rsyncing and remotely doing some work based on a logfile from a windows box from a centos backup server. I get the output from a vss snapshot that has a section like this: * SNAPSHOT ID = {639ef5df-c933-4496-878a-ed57b9d52876} ... - Shadow copy Set: {427ac5db-21be-4c53-8ca4-24e7bac86a1d} - Original count of shadow copies = 2 - Original Volume name: \\?\Volume{787bdf7a-ccff-11dd-9866-806e6f6e6963}\ [D:\] - Creation Time: 6/10/2009 12:12:08 PM - Shadow copy device name: \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy11 - Originating machine: milano.example.local - Service machine: milano.example.local - Not Exposed - Provider id: {b5946137-7b9f-4925-af80-51abd60b20d5} - Attributes: No_Auto_Release Persistent Differential * SNAPSHOT ID = {fb5996cf-a35b-4110-b83c-45f9c64a75f3} ... - Shadow copy Set: {427ac5db-21be-4c53-8ca4-24e7bac86a1d} - Original count of shadow copies = 2 - Original Volume name: \\?\Volume{787bdf7b-ccff-11dd-9866-806e6f6e6963}\ [E:\] - Creation Time: 6/10/2009 12:12:08 PM - Shadow copy device name: \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy12 - Originating machine: milano.example.local - Service machine: milano.example.local - Not Exposed - Provider id: {b5946137-7b9f-4925-af80-51abd60b20d5} - Attributes: No_Auto_Release Persistent Differential My current script only uses sed/grep but I never had to deal with this case where now I need to do something based on the grep'ed/sed extraction of the value of "SNAPSHOT ID" based on volume name "D:" or "E:"? To make my script work without rewriting it, is there a sed method to only take the "SNAPSHOT ID" if the text indented beneath it has "D:", then do the same and extract "SNAPSHOT ID" if and only if "E:" follows? Thanks for any help! jlc