LinuxQuestions.org

LinuxQuestions.org (/questions/)
-   Programming (https://www.linuxquestions.org/questions/programming-9/)
-   -   GAWK/GREP Equivalent (https://www.linuxquestions.org/questions/programming-9/gawk-grep-equivalent-4175433710/)

metallica1973 10-23-2012 12:36 PM
GAWK/GREP Equivalent
 
What is GAWK equivalent to greps -B 5 -A 5?

Code:
zgrep -i "^oct 20" /var/log/syslog*|grep -iB 5 -A 5 'postfix\/pickup
/var/log/syslog.1.gz:Oct 20 01:55:01 elmo CROND[7682]: (mail) CMD (/usr/bin/python -S /usr/lib64/mailman/cron/gate_news)
/var/log/syslog.1.gz:Oct 20 02:00:01 elmo CROND[7701]: (mail) CMD (/usr/bin/python -S /usr/lib64/mailman/cron/gate_news)
/var/log/syslog.1.gz:Oct 20 02:00:02 elmo CROND[7704]: (root) CMD (/home/davider/scripts/backups/saintbk.sh full )
/var/log/syslog.1.gz:Oct 20 02:00:03 elmo kernel:  CIFS VFS: Error 0xfffffffb on cifs_get_inode_info in lookup of \backups\automated
/var/log/syslog.1.gz:Oct 20 02:00:03 elmo last message repeated 11 times
/var/log/syslog.1.gz:Oct 20 02:00:03 elmo postfix/pickup[7339]: 585F8E607F: uid=0 from=<root>
/var/log/syslog.1.gz:Oct 20 02:00:03 elmo postfix/cleanup[7716]: 585F8E607F: message-id=<20121020060003.585F8E607F@elmo.localdomain>
/var/log/syslog.1.gz:Oct 20 02:00:03 elmo postfix/qmgr[3925]: 585F8E607F: from=<root@elmo.localdomain>, size=1723, nrcpt=1 (queue active)
/var/log/syslog.1.gz:Oct 20 02:00:03 elmo postfix/local[7718]: 585F8E607F: to=<postfix@elmo.localdomain>, orig_to=<root>, relay=local, delay=0.32, delays=0.05/0.2/0/0.08, dsn=2.0.0, status=sent (delivered to mailbox)
/var/log/syslog.1.gz:Oct 20 02:00:03 elmo postfix/qmgr[3925]: 585F8E607F: removed
/var/log/syslog.1.gz:Oct 20 02:01:01 elmo CROND[7723]: (root) CMD (nice -n 19 run-parts --report /etc/cron.hourly)
--
/var/log/syslog.1.gz:Oct 20 03:55:01 elmo CROND[8208]: (mail) CMD (/usr/bin/python -S /usr/lib64/mailman/cron/gate_news)
/var/log/syslog.1.gz:Oct 20 04:00:01 elmo CROND[8227]: (mail) CMD (/usr/bin/python -S /usr/lib64/mailman/cron/gate_news)
/var/log/syslog.1.gz:Oct 20 04:00:01 elmo CROND[8230]: (root) CMD (/home/davider/scripts/backups/spacechk.sh)
/var/log/syslog.1.gz:Oct 20 04:00:02 elmo kernel:  CIFS VFS: Error 0xfffffffb on cifs_get_inode_info in lookup of \backups\automated
/var/log/syslog.1.gz:Oct 20 04:00:02 elmo last message repeated 4 times
/var/log/syslog.1.gz:Oct 20 04:00:02 elmo postfix/pickup[8202]: 0D62FE607F: uid=0 from=<root>
/var/log/syslog.1.gz:Oct 20 04:00:02 elmo postfix/cleanup[8235]: 0D62FE607F: message-id=<20121020080002.0D62FE607F@elmo.localdomain>
/var/log/syslog.1.gz:Oct 20 04:00:02 elmo postfix/qmgr[3925]: 0D62FE607F: from=<root@elmo.localdomain>, size=1018, nrcpt=1 (queue active)
/var/log/syslog.1.gz:Oct 20 04:00:02 elmo postfix/local[8237]: 0D62FE607F: to=<postfix@elmo.localdomain>, orig_to=<root>, relay=local, delay=0.09, delays=0.08/0/0/0, dsn=2.0.0, status=sent (delivered to mailbox)
/var/log/syslog.1.gz:Oct 20 04:00:02 elmo postfix/qmgr[3925]: 0D62FE607F: removed
/var/log/syslog.1.gz:Oct 20 04:01:01 elmo CROND[8243]: (root) CMD (nice -n 19 run-parts --report /etc/cron.hourly)
Once the occurrence is found, I want to see 5 lines before and after. Thanks

metallica1973 10-23-2012 01:29 PM
I found a hellofa one liner that is equivalent to greps -A -B stuff:

Code:
gawk '{if(c-->0)print}{a[NR]=$0}/pattern/{for(i=NR-5;i<=NR;i++){print a[i]};c=5}' filename
chew on that one for a while:)

firstfire 10-23-2012 01:54 PM
Hi.

The following solution uses a ring buffer to store exactly B lines of previous context:
Code:
$ seq 1 50 | awk -vB=3 -vA=3 '/15/{for(n=1;n<=B;n++) print u[(i+n)%B]; print; a=A; next} {i=(i+1)%B; u[i]=$0} a-->0'
12
13
14
15
16
17
18
Currently it prints empty lines if there is not enough lines in the buffer. Unlike your solution it does not need to store whole input stream in memory.

Note also that
Code:
{if(c-->0)print}
is usually abbreviated to just
Code:
c-->0
in awk.

EDIT: output will look strange if pattern occurs more often than each B lines.


All times are GMT -5. The time now is 01:32 AM.