awk Arrays


 
Thread Tools Search this Thread
Top Forums Shell Programming and Scripting awk Arrays
# 1  
Old 01-21-2013
awk Arrays

So I'm back once again beating my head off a wall trying to figure out how to get this to work.

My end goal is to take input such as what's below, which will be capture in real time with a tail -f from a file or piped output from another command:
Code:
[2013/01/20 19:19:19] mod=syn|cli=192.168.1.102/56231|srv=192.168.1.110/443|subj=cli|os=Windows 7 or 8|dist=0|params=none|raw_sig=4:128+0:0:1460:8192,0:mss,nop,nop,sok:df,id+:0
[2013/01/20 19:19:19] mod=mtu|cli=192.168.1.102/56231|srv=192.168.1.110/443|subj=cli|link=Ethernet or modem|raw_mtu=1500
[2013/01/20 19:19:19] mod=syn|cli=192.168.1.102/56232|srv=192.168.1.110/443|subj=cli|os=Windows 7 or 8|dist=0|params=none|raw_sig=4:128+0:0:1460:8192,0:mss,nop,nop,sok:df,id+:0

And output it into something that looks like this:
Code:
Subject=cli
Server=192.168.1.110
Client=192.168.1.102
OS=Windows 7 or 8

etc. etc. for each line that it finds.

Below is what I've come up with so far, and it's not working properly.
Code:
awk -F"|" '{ { COUNT=1 }
        for(i=1;i<=NF;i++)
                {
                        if ($i ~ /cli=/)
                                {cli[$COUNT]=$i;gsub (/cli=/,"",cli[$COUNT]);}
                        if ($i ~ /srv=/)
                                {srv[$COUNT]=$i;gsub (/srv=/,"",srv[$COUNT]);}
                        if ($i ~ /subj=/)
                                {subj[$COUNT]=$i;gsub (/subj=/,"",subj[$COUNT]);}
                        if ($i ~ /os=/)
                                {os[$COUNT]=$i;gsub (/os=/,"",os[$COUNT]);}
                        { COUNT++ }
                }
        }
        {
        for(i=1;i<=COUNT;i++)
                {
                        {printf "Subject = %s\nServer = %s\nClient= %s\nOS= %s\n", subj[$i], srv[$i], cli[$i], os[$i];}
                        { i++ }
                }
        }'

I am trying to load the variables into an array as it runs through each pass so that I can print them out in the proper order... It doesn't seem to be working for me at all though.

If anyone could help, it would be appreciated.

Thanks,
-Shadow
# 2  
Old 01-21-2013
Code:
awk -F\| '{
 for(i=1;i<=NF;i++) {
  if($i ~ /subj=/) { sb=$i; gsub(/.*=/,"",sb); }
  if($i ~ /srv=/) { sr=$i; gsub(/.*=|\/.*/,"",sr); }
  if($i ~ /cli=/) { cl=$i; gsub(/.*=|\/.*/,"",cl); }
  if($i ~/os=/) { os=$i; gsub(/.*=/,"",os); }
  if(i==NF) { printf "Subject= %s\nServer= %s\nClient= %s\nOS= %s\n",sb,sr,cl,os; sb=sr=cl=os=""; }
 }
}' infile

This User Gave Thanks to Yoda For This Post:
# 3  
Old 01-21-2013
The printf statement can be moved out of the for loop, then the if statement is not required..

Last edited by Scrutinizer; 01-21-2013 at 02:25 AM..
# 4  
Old 01-21-2013
Quote:
Originally Posted by bipinajith
Code:
awk -F\| '{
 for(i=1;i<=NF;i++) {
  if($i ~ /subj=/) { sb=$i; gsub(/.*=/,"",sb); }
  if($i ~ /srv=/) { sr=$i; gsub(/.*=|\/.*/,"",sr); }
  if($i ~ /cli=/) { cl=$i; gsub(/.*=|\/.*/,"",cl); }
  if($i ~/os=/) { os=$i; gsub(/.*=/,"",os); }
  if(i==NF) { printf "Subject= %s\nServer= %s\nClient= %s\nOS= %s\n",sb,sr,cl,os; sb=sr=cl=os=""; }
 }
}' infile

Thank you Bipinajith!

So I'm going to explain what I think is happening, and someone can correct me if I'm wrong so I can learn here.

Once it reads through all the variables and stores what it finds, it gets to the if(i==NF) and that tells it that it's done and to print out what it has stored.

Then it sets all of the variables back to empty so they can be used again the next run without returning old information.

One question on this: /.*=|\/.*/

I'm guessing that .*= means pick up anything before the equal sign and remove it.

What does the other side of that do? What does the |\/.* do?

I know that the \ is an excape character, so does it find anything after a / and remove it?
# 5  
Old 01-21-2013
Yes, you are right. \/.* removes everything after / for server & client IP addresses.

/ is a meta-character, hence it should be escaped.
This User Gave Thanks to Yoda For This Post:
# 6  
Old 01-21-2013
Quote:
Originally Posted by bipinajith
Yes, you are right. \/.* removes everything after / for server & client IP addresses.

/ is a meta-character, hence it should be escaped.
Thank you sir! Appreciate your quick responses and helpfulness.
Login or Register to Ask a Question

Previous Thread | Next Thread

10 More Discussions You Might Find Interesting

1. Shell Programming and Scripting

Using arrays with awk

I'm a little stuck and would be grateful of some advice! I have three files, two of which contain reference data that I want to add to a line of output in the third file. I can't seem to get awk to print array contents as I would expect. The input files are: # Input file AAA,OAA,0313... (2 Replies)
Discussion started by: maccas17
2 Replies

2. Shell Programming and Scripting

help in awk arrays!

Hi, buddies I am new to shell scripting and trying to solve a problem. I read about arrays in awk that they are quite powerful and are associative in nature. Awk Gurus Please help! I have a file: Id1 pp1 0t4 pp8 xy2 Id43 009y black Id6 red xy2 Id12 new pp1 black I have... (5 Replies)
Discussion started by: geli21
5 Replies

3. UNIX for Dummies Questions & Answers

awk arrays

Hi Can someone please explain the logic of awk arrays. I have been doing some reading but I dont understand this: #!/usr/bin/gawk -f { arr++; } end { for(i in arr) { print arr,i } } As I understand arr refs the arrays index, so while $2 is a string that cant... (2 Replies)
Discussion started by: chronics
2 Replies

4. Shell Programming and Scripting

arrays in awk

Hi, I have the following data in a file for example: Name="Fred","Bob","Peterson","Susan","Weseley" Age="24","30","28","23","45" Study="English","Engineering","Physics","Maths","Psychology" Code="0","0","1","1","0" Name="Fred2","Bob2","Peterson2","Susan2","Weseley2"... (14 Replies)
Discussion started by: james2009
14 Replies

5. Shell Programming and Scripting

awk arrays can do this better - but how?

Hi, I have spent the afternoon trawling Google, Unix.com and Unix in a Nutshell for information on how awk arrays work, and I'm not really getting too far. I ahve a batch of code that I am pretty sure can be better managed using awk, but I'm not sure how to use awk arrays to do what I'm... (1 Reply)
Discussion started by: littleIdiot
1 Replies

6. Shell Programming and Scripting

Arrays in awk

Hi, I've written the following code to manipulate the first 40 lines of a data file into my desired order: #!/bin/awk -f { if (NR<=(4)){ a=a$0" "} else { if ((NR >= (5)) && (NR <= (13))) { b=b$0" " } else {if ((NR >= (14)) && (NR <= (25))){ c=c$0" "} ... (5 Replies)
Discussion started by: catwoman
5 Replies

7. Shell Programming and Scripting

Need Help with awk and arrays

now its owkring - thanks fo rthe help all . (7 Replies)
Discussion started by: fusionX
7 Replies

8. Shell Programming and Scripting

awk arrays

Guys, OK so i have been trying figure this all all day, i guess its a pretty easy way to do it. Right, so i have to column of data which i have gotten from one huge piece of data. What i would like to do is to put both of these into one array using awk. Is this possible?? If so could... (1 Reply)
Discussion started by: imonthejazz
1 Replies

9. Shell Programming and Scripting

arrays in awk???

Been struggling with a problem, I have been trying to do this in awk, but am unable to figure this out, I think arrays have to be used, but unsure how to accomplish this. I have a input file that looks like this: 141;ny;y;g 789;ct;e;e 23;ny;n;u 45;nj;e;u 216;ny;y;u 7;ny;e;e 1456;ny;e;g... (3 Replies)
Discussion started by: craigsky
3 Replies

10. UNIX for Advanced & Expert Users

Two or more arrays in Awk

Hi All, I have been working on awk and arrays. I have this small script: cat maillog*|awk -F: '$2=="SMTP-Accept" && $5~/string/ {lastdate=substr($1,1,8); internaluser=$5; v++} END {for (j in v) {print lastdate, v, j}'| sort>> mail.list This gives me the number of mails users are getting. ... (1 Reply)
Discussion started by: nitin
1 Replies
Login or Register to Ask a Question