CODEWITHSUNDEEP
linuxunixawk
Isky
Isky

Reputation: 1398

Extract result using AWK command

With this command : 

cat access.log | grep file | grep xx.xx.xx.xx | awk -F "-" '{print $3}' | awk -F "[" '{print $2}' | awk -F "]" '{print $1}' | awk -F " " '{print $1}'

I obtain this result : 

10/Nov/2015:17:38:47

I need to have in output the result formatted like this :

10/Nov/2015:17

I try adding this : 

awk -F ":" '{print $1,":",$2}'

But i obtain : 

10/Nov/2015 : 17

How can i obtain the result without that blank? Thanks :)

Upvotes: 0

Views: 65

Answers (3)

karakfa
karakfa

Reputation: 67467

Using the same log file @Sobrique's answer you can try this simpler script

awk '/^64.242.88.10/ && /twiki/ {print $4}' access.log | cut -c2-15

assuming you're interested in a specific ip and keyword=twiki (file in your example)

Upvotes: 0

Sobrique
Sobrique

Reputation: 53478

I think you're approaching this a horrible way - chaining multiple greps and awks is almost certainly redundant.

I'm going to take a bit of a guess that you're looking at a httpd access log looking like this: (from: http://www.monitorware.com/en/logsamples/apache.php)

64.242.88.10 - - [07/Mar/2004:16:05:49 -0800] "GET /twiki/bin/edit/Main/Double_bounce_sender?topicparent=Main.ConfigurationVariables HTTP/1.1" 401 12846
64.242.88.10 - - [07/Mar/2004:16:06:51 -0800] "GET /twiki/bin/rdiff/TWiki/NewUserTemplate?rev1=1.3&rev2=1.2 HTTP/1.1" 200 4523
64.242.88.10 - - [07/Mar/2004:16:10:02 -0800] "GET /mailman/listinfo/hsdivision HTTP/1.1" 200 6291
64.242.88.10 - - [07/Mar/2004:16:11:58 -0800] "GET /twiki/bin/view/TWiki/WikiSyntax HTTP/1.1" 200 7352
64.242.88.10 - - [07/Mar/2004:16:20:55 -0800] "GET /twiki/bin/view/Main/DCCAndPostFix HTTP/1.1" 200 5253
64.242.88.10 - - [07/Mar/2004:16:23:12 -0800] "GET /twiki/bin/oops/TWiki/AppendixFileSystem?template=oopsmore¶m1=1.12¶m2=1.12 HTTP/1.1" 200 11382
64.242.88.10 - - [07/Mar/2004:16:24:16 -0800] "GET /twiki/bin/view/Main/PeterThoeny HTTP/1.1" 200 4924
64.242.88.10 - - [07/Mar/2004:16:29:16 -0800] "GET /twiki/bin/edit/Main/Header_checks?topicparent=Main.ConfigurationVariables HTTP/1.1" 401 12851
64.242.88.10 - - [07/Mar/2004:16:30:29 -0800] "GET /twiki/bin/attach/Main/OfficeLocations HTTP/1.1" 401 12851

To get what you want out of it:

#!/usr/bin/env perl 
use strict;
use warnings;

while ( <> ) {
    if ( m/64.242.88.10/
     and m/TWiki/ )       { 
        my ($date, $tz) = m/\[(\S+):\d{2}:\d{2} ([-+\d]+)\]/;
        print $date,"\n";
    }
}

Which prints:

07/Mar/2004:16
07/Mar/2004:16
07/Mar/2004:16

This can be one-liner-ified thus:

perl -lne 'if (m/64.242.88.10/ and m/TWiki/ and m/\[(\S+):\d{2}:\d{2} / ) { print $1 }' access.log

Or as noted by glenn jackman:

perl -lne '/64.242.88.10/ && /TWiki/ && /\[(\S+):\d{2}:\d{2} / && print $1' access.log

Upvotes: 0

Tom Fenech
Tom Fenech

Reputation: 74596

Just remove the commas, so awk doesn't insert the OFS (a space by default) between each field:

awk -F ":" '{print $1":"$2}'

Though it'd be more idiomatic to set the OFS yourself:

awk -F ":" -v OFS=":" '{print $1,$2}'

Upvotes: 3

Related Questions