LinuxQuestions.org
Download your favorite Linux distribution at LQ ISO.
Go Back   LinuxQuestions.org > Forums > Non-*NIX Forums > Programming
User Name
Password
Programming This forum is for all programming questions.
The question does not have to be directly related to Linux and any language is fair game.

Notices


Reply
  Search this Thread
Old 03-22-2005, 04:12 PM   #1
pld
Member
 
Registered: Jun 2003
Location: Southern US
Distribution: Ubuntu 5.10
Posts: 206

Rep: Reputation: 30
quick hand with awk multiple field separators


Okay, I'm just trying to extract date/time information from apache logs.
standard logs, nothing changed, have the date/time information inside of square brackets:

65.5.80.194 - - [22/Mar/2005:09:48:10 -0800] "GET ......

Now, I was just going to use awk to list just the date/time, but I feel like maybe i am missing something. I want to use either of the square brackets as field separators(sp?), but cannot seem to figure it out...

any point me to what is probably an obvious solution?

tia

edit:: I am aware that this could be done with piping to yet another awk command, but I was really hoping there might be a more elegant solution...

Last edited by pld; 03-22-2005 at 04:17 PM.
 
Old 03-22-2005, 04:19 PM   #2
kev82
Senior Member
 
Registered: Apr 2003
Location: Lancaster, England
Distribution: Debian Etch, OS X 10.4
Posts: 1,263

Rep: Reputation: 51
cat logfile.log | cut -f 2 -d '[' | cut -f 1 -d ']'

you could call it a cheat but it works well enough
 
Old 03-22-2005, 04:32 PM   #3
TheLinuxDuck
Member
 
Registered: Sep 2002
Location: Tulsa, OK
Distribution: Slack, baby!
Posts: 349

Rep: Reputation: 33
In order to change the field separaters in awk, you use the command line switch -F. However, I couldn't get it to recognize []'s as legitimate charcters in that field.
 
Old 03-22-2005, 04:32 PM   #4
pld
Member
 
Registered: Jun 2003
Location: Southern US
Distribution: Ubuntu 5.10
Posts: 206

Original Poster
Rep: Reputation: 30
This would be functionally equivalent to:

cat logfile.log | awk -F[ '{print $2}' | awk -F] '{print $1}'

wouldnt it? I believe this is the first time I have ever seen the cut command love learning something new to put in the toolkit!
 
Old 03-22-2005, 04:36 PM   #5
pld
Member
 
Registered: Jun 2003
Location: Southern US
Distribution: Ubuntu 5.10
Posts: 206

Original Poster
Rep: Reputation: 30
Yeah, they are functionally identical to each other.

Thanks duck, I am still having the same problem. Its a multiple field separator problem. I can get awk to use just a single "[" as a field separator, but not "[" and "]"...
 
Old 03-22-2005, 05:02 PM   #6
kev82
Senior Member
 
Registered: Apr 2003
Location: Lancaster, England
Distribution: Debian Etch, OS X 10.4
Posts: 1,263

Rep: Reputation: 51
Sorry, I missed your edit. I personally think the two pipes version is much easier to read and hence better, but if you prefer a single pipe solution the most obvious one I can think of is

cat logfile | sed -e 's%.*\[\(.*\)\].*%\1%'
 
Old 03-22-2005, 05:06 PM   #7
keefaz
LQ Guru
 
Registered: Mar 2004
Distribution: Slackware
Posts: 6,552

Rep: Reputation: 872Reputation: 872Reputation: 872Reputation: 872Reputation: 872Reputation: 872Reputation: 872
You could use also :

cut -d' ' -f4 /var/log/apache/access_log | tr -d '['
 
Old 03-22-2005, 10:38 PM   #8
pld
Member
 
Registered: Jun 2003
Location: Southern US
Distribution: Ubuntu 5.10
Posts: 206

Original Poster
Rep: Reputation: 30
Thanks everyone! I appreciate the help. In the end, i agree that the two pipes is much easier to understand and use...
 
Old 03-09-2010, 01:13 PM   #9
jakemagee
LQ Newbie
 
Registered: May 2009
Posts: 3

Rep: Reputation: 0
Ok, so this looks really funny... but it appears to be your answer.

awk -F [][] '{print $2}'

you can also do the following to make it a little clearer.

awk -F [\]\[] '{print $2}'
 
Old 03-09-2010, 01:30 PM   #10
primerib
Member
 
Registered: Mar 2010
Posts: 48

Rep: Reputation: 20
You could also use sed:

cat logfile |sed -e 's/.*\[//;s/\].*//'
 
Old 05-28-2010, 07:51 AM   #11
Martin Rogers
LQ Newbie
 
Registered: May 2010
Location: Epsom, UK
Distribution: RHE5, CentOS, Ubuntu
Posts: 1

Rep: Reputation: 0
Works with jrockit verbose logs too

Quote:
Originally Posted by jakemagee View Post
Ok, so this looks really funny... but it appears to be your answer.

awk -F [][] '{print $2}'

you can also do the following to make it a little clearer.

awk -F [\]\[] '{print $2}'
This does the trick for me. I need to pull the timestamp field out of a verbose GC log from JRockit. I had been trying variations on this

awk -F ' *[/[/]] *'

.. which did not work at all. Thanks!
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
AWK: print field to end, and character count? ridertech Linux - Newbie 1 05-07-2004 05:07 PM
Multiple Field Seperators in Awk... TheDarktrooper Programming 6 05-06-2004 04:50 AM
My field separator changes when using awk Helene Programming 3 05-01-2004 08:10 AM
Two field seperators in awk?? Astro Programming 2 11-09-2003 10:12 AM
storing multiple values within one field in mysql antken Programming 8 12-15-2002 10:08 PM

LinuxQuestions.org > Forums > Non-*NIX Forums > Programming

All times are GMT -5. The time now is 04:01 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration