CODEWITHSUNDEEP
linuxshellawk
Hans
Hans

Reputation: 591

awk, from last column to \r\n (CRNL)

I have a file with lines like so:

Internet Protocol Version 4, Src: 192.168.0.29 (192.168.0.29), Dst: www.l.google.com (64.233.187.104)
    Time to live: 128
    User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.5) Gecko/20041107 Firefox/1.0\r\n

if I use $NF I end up with:

rv:1.7.5)

but I want:

Firefox/1.0

I want to make my script, below, do that:

awk '
    /    User-Agent/{brow=$NF}
    END{
        print brow;
    }
'

any suggestions would be appreciated!

Full script: (fixed)

#!/bin/bash
echo $1;
awk '/    User-Agent/{print}' $1 > useragents_$1;
echo '----------------------------------------------------' >> useragents_$1;
sort useragents_$1 | uniq >> useragents_$1;
awk '
    /Internet Protocol Version 4, Src:/{ip=$(NF-4)}
    /    Time to live/{ttl++}
    /    Time to live/{sttl=$NF}
    /    User-Agent/{os=$(NF-6)" "$(NF-5)}
    /    User-Agent/{brow=$NF}
    /    User-Agent/{agent++}
    /    User-Agent/{stringtemp=sttl"\t"ip"\t"os"\t"brow}
    /Windows/{windows++}
    /Linux/{linux++}
    /Solaris/{solaris++}
    END{
        sub(/\\r.*$/, "", brow);
        print "TTL\tIP\t\tOS\t\tBROWSER";
        print stringtemp;
        print "\nSUMMARY";
        print "\tttl\t=\t"ttl; print "\twindows\t=\t"windows;
        print "\tlinux\t=\t"linux; print "\tsolaris\t=\t"solaris;
        print "\tagent\t=\t"agent
    }
' $1 > useragents_$1;
more useragents_$1;

Output:

examplehttppacket.txt
TTL     IP              OS              BROWSER
128     192.168.0.29    Windows NT      Firefox/1.0\r\n

SUMMARY
        ttl     =       1
        windows =       3
        linux   =
        solaris =
        agent   =       1

Thanks for all your help everybody, looks like it was mostly a text file problem!

Upvotes: 1

Views: 252

Answers (4)

anubhava
anubhava

Reputation: 785631

This awk should work:

awk '/User-Agent/{brow=$NF} END{sub(/\\r.*$/, "", brow); print brow;}' file

Upvotes: 2

shellter
shellter

Reputation: 37298

I guess the first thing to try is to remove the \r chars

awk '
    {gsub(/^M/, "", $0)}
    /    User-Agent/{brow=$NF}
    END{
        print brow;
    } file

If using the VI(M) editor, enter the Ctrl-M (^M above) as one char, and using vi(m)s escape char feature, by pressing Ctrl-V (and then) Ctrl-M.

IHTH

Upvotes: 1

Nikolai Popov
Nikolai Popov

Reputation: 5685

awk '/User-Agent/{brow=$NF}; END{print brow;}' file_name

Works fine.

Upvotes: 1

larsks
larsks

Reputation: 312203

If I assume that your sample script has a typo (i.e., that you mean /User-Agent/, with no leading spaces), then given this input file:

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.5) Gecko/20041107 Firefox/1.0

And this script:

awk '
    /User-Agent/{brow=$NF}
    END{
        print brow;
    }
'

Then I get this output:

Firefox/1.0

Which seems to be exactly what you want. If you're seeing different behavior, please update your question with information about your operating system and an example of actual input and actual output that demonstrates the problem.

Upvotes: 1

Related Questions