Shell Programming and Scripting

Hi,

I'm working on a little script, for first I transformed epoch (unix date in seconds) in a human readable date in this way

cat arp.dat | sort -k 3 | gawk '{ print strftime("%d:%m:%Y:%H:%M", $3),$1,$2}'

the result is

06:03:2006:10:01 0:a:e4:c0:b5:6d 192.168.1.3
06:03:2006:12:15 0:a:e4:c0:b5:6e 192.168.1.4
......
07:03:2007:09:18 0:a:e4:c0:b5:6d 192.168.1.8

I am interested in parsing the arpwatch file and retaining just the more recent entries and produce another file, so I have to compare dates. How can I do?

Code:

awk -F":" ' $3 == 2007 && $2 > 2 ' file >newfile

Add conditions according to your needs

I don't understand very well where you say "add conditions according to your needs". The matter is a little more complicated, I've got about 2.000 entries, sometimes I've got something like this

01.01.2007:10.15 aa:bb:ecc. 1.2.3.4
01.01.2007:10.16 aa:bb:ecc. 1.2.3.5

(our lan is divided in pieces and uses DHCP, so a computer a laptop for example can have a complitely different ip in minutes)

so it's not pratical using == 2007(and eventually other statements) I think I need some kind of a function date/compare on date fild (as well hour) or maybe I miss something in your suggestion please give me details.

Code:

awk ' { arr[$2]=$0 } 
END {
     for(key in arr) { print arr[key] }
}' file > newfile

Thank you very much but I don't understand. I know is a fault of mine, I am a very beginning awk scripter. Can you give me a complete code, it' seems to me that is the key statement that is the "key" but I don't understand how to use it.

Code:

$ cat file
06:03:2006:10:01 0:a:e4:c0:b5:6d 192.168.1.3
06:03:2006:12:15 0:a:e4:c0:b5:6e 192.168.1.4
07:03:2007:09:18 0:a:e4:c0:b5:6d 192.168.1.8
01.01.2007:10.15 aa:bb:ecc. 1.2.3.4
01.01.2007:10.16 aa:bb:ecc. 1.2.3.5
$ awk ' { arr[$2]=$0 }
> END {
>      for(key in arr) { print arr[key] }
> }' file
07:03:2007:09:18 0:a:e4:c0:b5:6d 192.168.1.8
06:03:2006:12:15 0:a:e4:c0:b5:6e 192.168.1.4
01.01.2007:10.16 aa:bb:ecc. 1.2.3.5

If this is not the expected output, can you show sample input and output?

Ok. Input file

date mac ip
01:01:01:10.01 aa:bb:cc:dd:ee:ff 1.2.3.4
01:01:01:10.02 aa:bb:cc:dd:ee:ff 1.2.3.3
01:01:01:10.03 aa:bb:cc:dd:ee:ff 1.2.3.5
01:01:01:10.04 aa:bb:cc:dd:ee:ff 1.2.3.8
....
05:01:01:10.01 aa:bb:cc:dd:ee:00 1.2.3.9

I want this output file
01:01:01:10.04 aa:bb:cc:dd:ee:ff 1.2.3.8
05:01:01:10.01 aa:bb:cc:dd:ee:00 1.2.3.9

I can have hundreds of entries in the input file, some have just one triplet (date mac ip) and I want this rows to be reported, some have many triplets where there is only one identical element the mac, data and ip are different in this case I want only the most recent row and the others supressed.