[SOLVED] AWK Restrictive Search

metallica1973 · 07-06-2012, 02:25 PM

I have a file with most of the lines formatted in this way:

Code:

testaccount:D#%G%^V&:MeMyselfandI:memyselfandi@somesite.com:11/242012:192.168.1.1,192.168.1.2,192.168.1.3,192.168.1.4,192.168.1.5

There are a few lines with:

Code:

testaccount2:D#%G%^V&:MeMyselfandI:memyselfandi@somesite.com:11/242012:192.168.1.1,192.168.1.2,192.168.1.3,192.168.1.4,192.168.1.5:reminder2012 $56.00

and 
testaccount2:D#%G%^V&:MeMyselfandI:memyselfandi@somesite.com:11/242012:192.168.1.1,192.168.1.2,192.168.1.3,192.168.1.4,192.168.1.5:$56.00

using AWK I have a one-liner that excludes case sensitivity, uses the field delimeter ":" and searches for the account name and if there is any ip adress/ip adresses associated with the string:

Code:

cat wspasswd| awk -F ':' 'tolower($1) ~ /^testaccount2/ && /[0-9][0-9][0-9][0-9]/'

which print the whole sting correctly:

Code:

testaccount2:D#%G%^V&:MeMyselfandI:memyselfandi@somesite.com:11/242012:192.168.1.1,192.168.1.2,192.168.1.3,192.168.1.4,192.168.1.5:$56.00

That is fine but my question is, how can I have awk additionally, once it finds the account name and the ip adress/ip adresses to print out "only the ip adress/ip adresses"

using testaccount2 as an example

Code:

cat wspasswd| awk -F ':' 'tolower($1) ~ /^testaccount2/ && /[0-9][0-9][0-9][0-9]/ {print $(NF-1)}'
192.168.1.1,192.168.1.2,192.168.1.3,192.168.1.4,192.168.1.5

The above worked because the ip addess/ip address reside in the next to last field but what do I do if the field is in the last field. Is there a way I can tell AWK once it finds the account name and the ip adress/ip adresses to print out "only the ip adress/ip adresses" no matter where they are in the sting?

druuna · 07-06-2012, 03:00 PM

You've set the delimiter to : the IP field seems to be 6 in your example. If that is always the case:

Code:

awk -F ':' 'tolower($1) ~ /^testaccount2/ && /[0-9][0-9][0-9][0-9]/ { print $6 }' wspasswd

$1 is first field, $2 second etc ($0 is the complete line).

metallica1973 · 07-06-2012, 03:18 PM

Many thanks,

That would apply if ip address/ip addresses field was always the 6th field, but will vary from the last field to next to the last field.

Code:

testaccount:D#%G%^V&:MeMyselfandI:memyselfandi@somesite.com:11/242012:192.168.1.1,192.168.1.2,192.168.1.3,192.168.1.4,192.168.1.5

testaccount2:D#%G%^V&:MeMyselfandI:memyselfandi@somesite.com:11/242012:192.168.1.1,192.168.1.2,192.168.1.3,192.168.1.4,192.168.1.5:reminder2012 $56.00

testaccount3:D#%G%^V&:MeMyselfandI:memyselfandi@somesite.com:11/242012:192.168.1.1,192.168.1.2,192.168.1.3,192.168.1.4,192.168.1.5:$56.00

is there a way to have AWK look for the account name "search for ip address/ip addresses then search for the ip address/ip adddresses and print what is returned

Code:

cat wspasswd| awk -F ':' 'tolower($1) ~ /^testaccount2/ && /[0-9][0-9][0-9][0-9]/ /[0-9][0-9][0-9][0-9/ {print $(NF)}'

druuna · 07-06-2012, 03:25 PM

If the examples you give are correct, the IP field is always the sixth field. Sometimes the sixth field is the last field and sometimes there are more fields, but that doesn't matter.

Or provide example data that reflects the real data.

metallica1973 · 07-06-2012, 03:39 PM

Another forum has suggested this but it doest appear to work. It prints nothing.

Code:

cat wspasswd | awk -F: 'tolower($1) ~ /^testaccount2/{for(i=1;i<=NF;i++){if($i ~ /[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}/) print $i}}'

?

druuna · 07-06-2012, 03:40 PM

Try this:

Code:

awk -F ':' 'tolower($1) ~ /^testaccount2/ { for ( i = 1; i <= NF; i++ ) { if ( $i ~ /[0-9]*\.[0-9]*\.[0-9]*\.[0-9]*/ ) print $i } }' wspasswd

Little less accurate, but should work.

metallica1973 · 07-06-2012, 04:00 PM

Code:

testaccount:D#%G%^V&:MeMyselfandI:memyselfandi@somesite.com:11/242012:192.168.1.21,192.168.14.26,192.168.21.93,192.168.41.44,192.168.41.95

testaccount2:D#%G%^V&:MeMyselfandI:memyselfandi@somesite.com:11/242012:192.168.1.1,192.168.1.2,192.168.1.3,192.168.1.4,192.168.1.5:reminder2012 $12.00

testaccount3:D#%G%^V&:MeMyselfandI:memyselfandi@somesite.com:11/242012:192.154.12.11,192.154.13.26,192.154.12.13,192.154.17.49,192.154.17.53:$7500.00

testaccount4:S#$G%^UJHG:MeMyselfandI:memyselfandi@somesite.com:11/242012:192.168.1.51,192.168.1.52,192.168.1.53,192.168.1.54,192.168.51.50:$5600.00

testaccount5:11/242012:192.168.12.51,192.168.12.52,192.168.12.53,192.168.12.54,192.168.12.50

Sorry, as you can see from above the ip address it can be in various different fields {$3,$6}. Is there a way I can tell AWK once it finds the account name and the ip adress/ip adresses to print out "only the ip adress/ip adresses" no matter where they are in the string

metallica1973 · 07-06-2012, 04:08 PM

thanks for all your help/

After I took a closer look at the data file, the 6th data field always reflects the ip address/ip addresses so your example will work, also your adjustment works for my original questions.

Code:

awk -F ':' 'tolower($1) ~ /^testaccount2/ { for ( i = 1; i <= NF; i++ ) { if ( $i ~ /[0-9]*\.[0-9]*\.[0-9]*\.[0-9]*/ ) print $i } }' wspasswd

Your awesome!!!!!

grail · 07-07-2012, 12:04 PM

I would just add that the reason the earlier example did not work is due to the intervals being used. Anything prior to version 4 of gawk will require the additional switch of --re-interval