I tried your second awk, and it appears that it is assuming the IPs in the log file will always be a specific column. that's accurate. and its my fault for not pointing that out.

the ips can be in any column. so i'm not sure how you'd tweak your awk statement to do that. btw, there was a missing "}" in it, so i changed it to this:

Code:

awk '/FAILURE/{print $(NF-1), $NF}' lfile | awk -F- '{if(seen[$2,$3]){cnt[$2]++; seen[$2,$3]++; }  if(cnt[$2]>1) print $2,$3}'

as you can see, i dropped it from 10 to 1, but still, nothing was spat out from the log even though there should have been.

---------- Post updated at 09:07 AM ---------- Previous update was at 09:03 AM ----------

looks like this could work. when i ran your command i got something like this:

Code:

10 unique IPs found in FAILURE
10.51.65.16-1521

10.50.44.188-1521
10.51.111.22-7443
10.51.101.29-1443
10.58.60.21-1521
10.51.19.12-7443
10.11.34.23-1443
10.51.19.15-80
10.51.65.17-1521

the script is suppose to only count IPs that occur at least 10 times in the log file. looks like this is counting all IPs. and i'm not sure where it is applying the threshold of 10. but it looks like this could very well work.

also, notice the blank line. not sure what that means.