CODEWITHSUNDEEP
bashshellgrep
user3486059
user3486059

Reputation: 121

shell script display grep results

I need some help with displaying how many times two strings are found on the same line! Lets say I want to search the file 'test.txt', this file contains names and IP's, I want to enter a name as a parameter when running the script, the script will search the file for that name, and check if there's an IP-address there also. I have tried using the 'grep' command, but I don't know how I can display the results in a good way, I want it like this: 

Name: John Doe IP: xxx.xxx.xx.x count: 3

The count is how many times this line was found, this is how my grep script looks like right now: 

#!/bin/bash 
echo "Searching $1 for the Name '$2'"

result=$(grep "$2" $1 | grep -E "(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)")

echo $result

I will run the script like 'sh search test.txt John'. I'm having trouble displaying the information I get from the grep command, maybe there's a better way to do this?

EDIT:

Okey, I will try to explain a little better, let's say I want to search a .log file, I want a script to search that file for a string the user enters as a parameter. i.e if the user enters 'sh search test.log logged in' the script will search for the string "logged in" within the file 'test.log'. If the script finds this line on the same line as a IP-address the IP address is printed, along with how many times this line was found.

And I simply don't know how to do it, I'm new to shell scripting, and was hoping I could use grep along with regular expressions for this! I will keep on trying, and update this question with an answer if I figure it out.

I don't have said file on my computer, but it looks something like this: 

Apr 25 11:33:21 Admin CRON[2792]: pam_unix(cron:session): session opened for user 192.168.1.2 by (uid=0)
Apr 25 12:39:01 Admin CRON[2792]: pam_unix(cron:session): session closed for user 192.168.1.2
Apr 27 07:42:07 John CRON[2792]: pam_unix(cron:session): session opened for user 192.168.2.22 by (uid=0)
Apr 27 14:23:11 John CRON[2792]: pam_unix(cron:session): session closed for user 192.168.2.22
Apr 29 10:20:18 Admin CRON[2792]: pam_unix(cron:session): session opened for user 192.168.1.2 by (uid=0)
Apr 29 12:15:04 Admin CRON[2792]: pam_unix(cron:session): session closed for user 192.168.1.2

Upvotes: 0

Views: 20150

Answers (1)

tripleee
tripleee

Reputation: 189357

Here is a simple Awk script which does what you request, based on the log snippet you posted.

awk -v user="$2" '$4 == user { i[$11]++ }
    END { for (a in i) printf ("Name: %s IP: %s count: %i\n", user, a, i[a]) }' "$1"

If the fourth whitespace-separated field in the log file matches the requested user name (which was passed to the shell script as its second parameter), add one to the count for the IP address (from field 11).

At the end, loop through all non-zero IP addresses, and print a summary for each. (The user name is obviously whatever was passed in, but matches your expected output.)

This is a very basic Awk script; if you think you want to learn more, I urge you to consult a simple introduction, rather than follow up here.

If you want a simpler grep-only solution, something like this provides the information in a different format:

grep "$2" "$1" |
grep -o -E '(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)' |
sort | uniq -c | sort -rn

The trick here is the -o option to the second grep, which extracts just the IP address from the matching line. It is however less precise than the Awk script; for example, a user named "sess" would match every input line in the log. You can improve on that slightly by using grep -w in the first grep -- that still won't help against users named "pam" --, but Awk really gives you a lot more control.

My original answer is below this line, partly becaus it's tangentially useful, partially because it is required in order to understand the pesky comment thread below.

The following

result=$(command)
echo $result

is wrong. You need the second line to be

echo "$result"

but in addition, the detour over echo is superfluous; the simple way to write that is simply

command

Upvotes: 1

Related Questions