UNIX for Dummies Questions & Answers

Hi all,

I need your help in understanding the meaning and syntax of the below nawk line.
Here is an extract of a script which I use daily and works well. The script extracts the hostnames and messages within a syslog file. I would also like to extract the message time in the 3rd column by updating the nawk line, but need your help to do it:

Code:

grep $messages syslog.`date +%d%m%y`.log | \
nawk -F '%' '{ split($1,a," "); print a[4], "%"$2 }' | \
sort -k3.2,3 -k2,2 -k1nr,1 | \

Regards, Wynford



---------- Post updated at 03:11 PM ---------- Previous update was at 02:37 PM ----------




I've now found out how to adapt the nawk line to show the time column, see below:

Code:

nawk -F '%' '{ split($1,a," "); print a[3], b[4], "%"$2 }'

I still now need an explanation of the whole line.

Wynford

-F '%' - this defines % as the primary field separator.

split($1, a, " ") - using field $1 (field #1 ) create an array that is split up using space(s) as the separator, creating subfields out of $1.

print the 3rd and 4th subfield of $1, print the "%" character, then primary field #2.

If you are doing sysadmin work you have to know shell and awk. Period.

Seriously consider getting a copy of Dougherty & Robbins 'sed & awk' - you can get an ebook for a lot less than paper.

Thanks Jim, much appreciated