[SOLVED] Get awk to print relevant fields instead of every field

itachi8009 · 08-06-2013, 07:34 PM

I have an awk statement that goes through a file to print out certain fields

Code:

awk -F";" -v ip="$AsArg" 'BEGIN {OFS="\t"};{if (ip==$5) dir="OUT" ;else if (ip==$6) dir="IN" };{printf "%3s\t %6s\t %6s\t %4s %8d %7d %10s\n", dir,$3,$4,$7,$8,$9,$1 }'

The if statement is suppose to decide the direction and the rest of the fields are from the file itself, however, when I run it, it gives me every line, how do I get awk to print the lines that match the ip variable, instead of every line in the file?

Sydney · 08-06-2013, 08:11 PM

Code:

awk -F";" -v 
ip="$AsArg" 
'BEGIN 
    {OFS="\t"};
    {if (ip==$5) 
         dir="OUT";
    else if (ip==$6)
         dir="IN";}

     {printf "%3s\t %6s\t %6s\t %4s %8d %7d %10s\n", dir,$3,$4,$7,$8,$9,$1 }
'

I think you would be happier doing this with grep but dir="IN"}; should have the ; moved. You may also want to provide some input and what you hope the output to be.

itachi8009 · 08-06-2013, 08:22 PM

Quote:

Originally Posted by Sydney

Code:

awk -F";" -v 
ip="$AsArg" 
'BEGIN 
    {OFS="\t"};
    {if (ip==$5) 
         dir="OUT";
    else if (ip==$6)
         dir="IN";}

     {printf "%3s\t %6s\t %6s\t %4s %8d %7d %10s\n", dir,$3,$4,$7,$8,$9,$1 }
'

I think you would be happier doing this with grep but dir="IN"}; should have the ; moved. You may also want to provide some input and what you hope the output to be.

Here's some of the output - 100 lines

Code:

OUT	 virbr0	   eth1	  UDP     5534   13183 10:49:18 24 Apr
OUT	 virbr0	       	  TCP    17024   19068 14:10:21 14 Feb
OUT	    em2	    em0	 ICMP        0       0 04:48:16 23 Aug
OUT	    em0	   eth1	  UDP    19986   24286 15:23:17 03 Apr
OUT	    em2	   eth0	  TCP    10064    2443 04:11:51 15 Nov

however when I search through the file for the IP I used, it comes up with 11 lines
The file it is reading from has 100 lines total, so it is disregarding the matching IP and just assigning everything with IN/OUT

Sydney · 08-06-2013, 08:28 PM

Okay so on your if else if you have no match for what to do if no match is made, since dir is not changed from the last match I think you will see it again.

itachi8009 · 08-06-2013, 08:32 PM

Quote:

Originally Posted by Sydney

Okay so on your if else if you have no match for what to do if no match is made, since dir is not changed from the last match I think you will see it again.

Sorry, but I have trouble understanding what you are saying, how do I make it so that it only gives me the entries that match the IP?

Firerat · 08-06-2013, 08:32 PM

Code:

awk -F";" -v 
ip="$AsArg" 
'BEGIN 
    {OFS="\t"};
    {if (ip==$5) 
         dir="OUT";
    else if (ip==$6)
         dir="IN";}

     /'$AsArg'/{printf "%3s\t %6s\t %6s\t %4s %8d %7d %10s\n", dir,$3,$4,$7,$8,$9,$1 }
'

itachi8009 · 08-06-2013, 08:42 PM

Quote:

Originally Posted by Firerat

Code:

awk -F";" -v 
ip="$AsArg" 
'BEGIN 
    {OFS="\t"};
    {if (ip==$5) 
         dir="OUT";
    else if (ip==$6)
         dir="IN";}

     /'$AsArg'/{printf "%3s\t %6s\t %6s\t %4s %8d %7d %10s\n", dir,$3,$4,$7,$8,$9,$1 }
'

Sorry, this doesn't work, it still gives me everything

Sydney · 08-06-2013, 08:49 PM

Code:

grep "$AsArg" -f file | 
awk -F";" -v 
ip="$AsArg" 
'BEGIN 
    {OFS="\t"};
    {if (ip==$5) 
         dir="OUT";
    else if (ip==$6)
         dir="IN";}

     /'$AsArg'/{printf "%3s\t %6s\t %6s\t %4s %8d %7d %10s\n", dir,$3,$4,$7,$8,$9,$1 }
'

itachi8009 · 08-06-2013, 08:54 PM

Quote:

Originally Posted by Sydney

Code:

grep "$AsArg" -f file | 
awk -F";" -v 
ip="$AsArg" 
'BEGIN 
    {OFS="\t"};
    {if (ip==$5) 
         dir="OUT";
    else if (ip==$6)
         dir="IN";}

     /'$AsArg'/{printf "%3s\t %6s\t %6s\t %4s %8d %7d %10s\n", dir,$3,$4,$7,$8,$9,$1 }
'

So it tries to find the IP from the file and then run it through awk?

Because what its doing instead is trying to read from a file with the name of the IP (grep: 192.168.1.1 No such file or directory)

and without the -f, it has no effect

Sydney · 08-06-2013, 08:56 PM

Quote:

Originally Posted by itachi8009

So it tries to find the IP from the file and then run it through awk?

Because what its doing instead is trying to read from a file with the name of the IP (grep: 192.168.1.1 No such file or directory)

Sorry drop the -f

itachi8009 · 08-06-2013, 08:59 PM

Quote:

Originally Posted by Sydney

Sorry drop the -f

-f won't work either, I'm still getting 100 lines

Sydney · 08-06-2013, 09:02 PM

so

Code:

grep "192.168.1.1" file | wc -l

returns 100 lines? If so that IP is on every line.

Firerat · 08-06-2013, 09:03 PM

Code:

awk -F";" -v ip="$AsArg" 'BEGIN{OFS="\t"};
    {if (ip==$5) 
         dir="OUT";
    else if (ip==$6)
         dir="IN";
    };
/'$AsArg'/{printf "%3s\t %6s\t %6s\t %4s %8d %7d %10s\n", dir,$3,$4,$7,$8,$9,$1 } '

itachi8009 · 08-06-2013, 09:05 PM

Quote:

Originally Posted by Sydney

so

Code:

grep "192.168.1.1" file

returns 100 lines? If so that IP is on every line.

Nope, ran grep with wc -l, 11 lines with the IP I am searching for (192.168.1.1 as an example)

ntubski · 08-06-2013, 09:08 PM

How could any of the solutions posted* even run? Aren't there some backslashes missing? I think this should work (but it would be helpful to have sample input to go with the sample output):

Code:

awk -F";" -v ip="$AsArg" '
BEGIN { OFS="\t"; }

{
    if (ip==$5) 
         dir="OUT";
    else if (ip==$6)
         dir="IN";
    else
         dir=0;
}
dir {printf "%3s\t %6s\t %6s\t %4s %8d %7d %10s\n", dir,$3,$4,$7,$8,$9,$1 }'

* There was some overlap in posting times, this refers only to posts before #13