CODEWITHSUNDEEP
awksed
mcgoosh
mcgoosh

Reputation: 59

Sed or awk. Find text between two strings + and additional identifier

I am looking to search a file and pull out data in between two strings. I am able to this with sed ok. But I also need it to only pull that information for a specific field. Example:

2015-04-29T08:05:24.668345-04:00 test1 [S=4444] [SID:1630710955] HOOK_EV

---SYSLOG DATA
2015-04-29T08:05:24.668345-04:00 test1 [S=4445] [SID:1630710956]
2015-04-29T08:05:24.668345-04:00 test1 [S=4444] [SID:1630710955] HOOK_EV_OFF

My sed statement can pull data in between the HOOK_EV and HOOK_EV_OFF strings. However I would like it to only pull data for the specific SID number. Currently it will pull all data in between the two strings but for everything. So in the example above I would like to only pull data for the SID:1630710955 in between the HOOK_EV and HOOK_EV_OFF string.

Can sed do all that?

Upvotes: 0

Views: 419

Answers (2)

Juan Diego Godoy Robles
Juan Diego Godoy Robles

Reputation: 14955

Here's an awk onliner:

awk -v sid=1630710955 '/HOOK_EV_OFF$/{flag=0;next}{if(flag && $0 ~ "SID:"sid){print}}/HOOK_EV$/{flag=1;next}' infile

Explanation:

awk -v sid=1630710955 '/HOOK_EV_OFF$/{flag=0;next} # Final pattern found   --> turn off the flag and read next line
                       {if(flag && $0 ~ "SID:"sid){print}} # if flag and SID pattern in line print it
                       /HOOK_EV$/{flag=1;next} # Initial pattern found --> turn on the flag and read the next line
                       ' infile

For a dynamic SIDextraction, you can use:

awk '/HOOK_EV_OFF$/{flag=0;SID="";next} 
     flag && $NF==SID
     /HOOK_EV$/{flag=1;SID=$(NF-1);next}' infile

Having this input file:

2015-04-29T08:05:24.668345-04:00 test1 [S=4444] [SID:1630710955] HOOK_EV
2015-04-29T08:05:24.668345-04:00 test1 [S=4445] [SID:1630710955]
2015-04-29T08:05:24.668345-04:00 test1 [S=4445] [SID:1630710956]
2015-04-29T08:05:24.668345-04:00 test1 [S=4444] [SID:1630710955] HOOK_EV_OFF
2015-04-29T08:05:24.668345-04:00 test1 [S=4445] [SID:1630710955]
2015-04-29T08:05:24.668345-04:00 test2 [S=4444] [SID:1630710965] HOOK_EV
2015-04-29T08:05:24.668345-04:00 test2 [S=4447] [SID:1630710965] 
2015-04-29T08:05:24.668345-04:00 test2 [S=4447] [SID:1630710967] 
2015-04-29T08:05:24.668345-04:00 test2 [S=4444] [SID:1630710965] HOOK_EV_OFF

The output will be:

2015-04-29T08:05:24.668345-04:00 test1 [S=4445] [SID:1630710955]
2015-04-29T08:05:24.668345-04:00 test2 [S=4447] [SID:1630710965]

Upvotes: 2

glenn jackman
glenn jackman

Reputation: 246837

sed -n '/HOOK_EV$/,/HOOK_EV_OFF$/ {/SID:1630710955/p}'

Upvotes: 3

Related Questions