Sponsored Content
Top Forums Shell Programming and Scripting Parsing kiwi syslog from Astaro Post 302519445 by ctsgnb on Wednesday 4th of May 2011 03:23:04 AM
Old 05-04-2011
I suspect your awk doesn't support multiple Field separator definition so it just put the whole line in $1 that is the reason why you only get blank lines returned.

On your Ubuntu machine, try replacing "awk" with "gawk" :

Code:
gawk -F"[=[:blank:]]" '{gsub("\"",x,$0);for(i=1;i<=NF;i++) if($i~/scrip|scrport|dstip|dstport/) printf $(i+1)" ";printf "\n"}' yourlogfile

ou can alternately try (with your ubuntu standard awk)

Code:
sed 's/  */=/g;s/=/ /g' yourlogfile | awk '{gsub("\"",x,$0);for(i=1;i<=NF;i++) if($i~/scrip|scrport|dstip|dstport/) printf $(i+1)" ";printf "\n"}'


Last edited by ctsgnb; 05-04-2011 at 04:50 AM..
 

We Also Found This Discussion For You

1. Shell Programming and Scripting

Parsing syslog from Linux

Hello, I'm facing problem to extract fields from below syslog : logver=56 idseq=63256900099118326 itime=1563205190 devid=FG-5KDTB18800138 devname=LAL-C1-FGT-03 vd=USER date=2019-07-15 time=18:39:49 logid="0000000013" type="traffic" subtype="forward" level="notice" eventtime=1563205189... (17 Replies)
Discussion started by: arm
17 Replies
JOIN(1) 						      General Commands Manual							   JOIN(1)

NAME
join - relational database operator SYNOPSIS
join [ options ] file1 file2 DESCRIPTION
Join forms, on the standard output, a join of the two relations specified by the lines of file1 and file2. If file1 is `-', the standard input is used. File1 and file2 must be sorted in increasing ASCII collating sequence on the fields on which they are to be joined, normally the first in each line. There is one line in the output for each pair of lines in file1 and file2 that have identical join fields. The output line normally con- sists of the common field, then the rest of the line from file1, then the rest of the line from file2. Fields are normally separated by blank, tab or newline. In this case, multiple separators count as one, and leading separators are dis- carded. These options are recognized: -an In addition to the normal output, produce a line for each unpairable line in file n, where n is 1 or 2. -e s Replace empty output fields by string s. -jn m Join on the mth field of file n. If n is missing, use the mth field in each file. -o list Each output line comprises the fields specified in list, each element of which has the form n.m, where n is a file number and m is a field number. -tc Use character c as a separator (tab character). Every appearance of c in a line is significant. SEE ALSO
sort(1), comm(1), awk(1) BUGS
With default field separation, the collating sequence is that of sort -b; with -t, the sequence is that of a plain sort. The conventions of join, sort, comm, uniq, look and awk(1) are wildly incongruous. 7th Edition April 29, 1985 JOIN(1)
All times are GMT -4. The time now is 01:43 PM.
Unix & Linux Forums Content Copyright 1993-2022. All Rights Reserved.
Privacy Policy