title: Terminal Server logon script
body: <p>I'm writing a simple .bat script to track logons to our terminal servers and append the records to a single CSV file. I can't quite get my script to behave correctly. Almost everything is working, but the <strong>clientip</strong> variable has an entire line of output instead of just the IP address that I desire. I don't think I'm doing the TOKENS correctly, and I suspect it's because the output of the netstat command isn't delimited by a tab character. </p>
  
  <pre><code>@ECHO OFF
  FOR /F "TOKENS=*" %%A IN ('TIME/T') DO SET TIME=%%A
  FOR /F "TOKENS=3 delims=&lt;tab&gt;" %%B IN ('netstat -n ^| find ":3389" ^| find "ESTABLISHED"') DO SET CLIENTIP=%%B
  echo Logon,%username%,%date%,%time%,%computername%,%clientip% &gt;&gt; \\dc01\c$\logons.csv
  </code></pre>
  
  <p>If an example output of <code>netstat -n | find ":3389" | find "ESTABLISHED"</code> is </p>
  
  <p><code>TCP    10.10.20.100:3389      68.46.xxx.xxx:50373     ESTABLISHED</code></p>
  
  <p>then how can I set the <strong>clientip</strong> variable to only (last digits redacted, of course) 68.46.xxx.xxx? A bonus would be leaving off the port, in this case ":50373".</p>