LinuxQuestions.org
Share your knowledge at the LQ Wiki.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Software
User Name
Password
Linux - Software This forum is for Software issues.
Having a problem installing a new program? Want to know which application is best for the job? Post your question in this forum.

Notices


Reply
  Search this Thread
Old 02-13-2019, 03:31 AM   #1
blason
Member
 
Registered: Feb 2016
Posts: 65

Rep: Reputation: Disabled
awk or any other command to pick up value next to matching?


Hi there,

My logs are coming in this format and I need to pickup the value associated with/or after "Destination DNS Hostname". Can someone please shed some light and help me on this?

Thanks and Regards,
Blason R

11:00:45 prevent 10.10.3.1 >lo session_id:{0x5c47eb62,0x38,0x10310ac,0xc0000001};Suppressed logs:40;sent_bytes:0;received_bytes:0;severity:4;log_id:2;src:192.168.100.199;dst:10.10.3.44;proto:t cp;Protection name:Andromeda.TC.co;description:Connection to DNS trap bogus IP. See sk74060 for more information.;Source OS:Windows;Confidence Level:3;malware_action:Communication with C&C site;Protection TypeNS Trap;malware_rule_id:{00000092-002C-0048-8719-E4CB04A2BCA8};Destination DNS Hostname:amnsreiuojy.ru;protection_id:00466580E;scope:192.168.100.199;product:Anti Malware;service:80;s_port:52478
 
Old 02-13-2019, 03:52 AM   #2
blason
Member
 
Registered: Feb 2016
Posts: 65

Original Poster
Rep: Reputation: Disabled
Tried multiple Tricks with awk but nothing worked

grep -o "Destination DNS Hostname"


sed '/Hostname/s/.*Hostname \([^ ][^ ]*\)[ ]*.*/\1/'


fixed_string=Hostname
awk -F '${fixed_string}' '{print $2}' file | awk '{print $1}'
 
Old 02-13-2019, 03:59 AM   #3
pan64
LQ Guru
 
Registered: Mar 2012
Location: Hungary
Distribution: debian/ubuntu/suse ...
Posts: 12,594

Rep: Reputation: 3936Reputation: 3936Reputation: 3936Reputation: 3936Reputation: 3936Reputation: 3936Reputation: 3936Reputation: 3936Reputation: 3936Reputation: 3936Reputation: 3936
you need to write a regexp to look for what you need. You can implement it in awk/grep/sed/perl/python/whatever you like.
Code:
grep -o -P '(?<=Destination DNS Hostname:)[^;]*'
awk ' BEGIN { RS=";"; FS=":" } /Destination DNS Hostname/ { print $2 }'
sed -n '/Destination DNS Hostname/{s/.*Destination DNS Hostname://;s/;.*//;p}'
 
Old 02-13-2019, 04:01 AM   #4
Turbocapitalist
Senior Member
 
Registered: Apr 2005
Distribution: Linux Mint, Devuan, OpenBSD
Posts: 3,909
Blog Entries: 3

Rep: Reputation: 1858Reputation: 1858Reputation: 1858Reputation: 1858Reputation: 1858Reputation: 1858Reputation: 1858Reputation: 1858Reputation: 1858Reputation: 1858Reputation: 1858
It sounds like you are trying something like this:

Code:
awk -F ';' '/Destination DNS Hostname/{sub(/^[^:]+:/,"",$17);print $17;}' /some/file.log

# or

awk -F ';' '$17~/^Destination DNS Hostname/{sub(/^[^:]+:/,"",$17);print $17;}' /some/file.log
 
Old 02-13-2019, 04:56 AM   #5
l0f4r0
Member
 
Registered: Jul 2018
Location: Paris
Distribution: macOS, Slackware
Posts: 805

Rep: Reputation: 282Reputation: 282Reputation: 282
Quote:
Originally Posted by pan64 View Post
Code:
sed -n '/Destination DNS Hostname/{s/.*Destination DNS Hostname://;s/;.*//;p}'
"Destination DNS Hostname" is redundant here
Anyway, you can simplify your command with:
Code:
sed -En 's/.*Destination DNS Hostname:([^;]+).*/\1/p'

Last edited by l0f4r0; 02-13-2019 at 04:57 AM.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
Find/grep command to find matching files, print filename, then print matching content stefanlasiewski Programming 9 06-30-2016 05:30 PM
[SOLVED] awk help (print matching line and next three) bradvan Programming 4 03-01-2012 05:11 AM
[SOLVED] awk with pipe delimited file (specific column matching and multiple pattern matching) lolmon Programming 4 08-31-2011 12:17 PM
difference between value *value and value * value PoleStar Linux - Newbie 1 11-26-2010 03:37 PM
awk command to find if any one argument is matching Ashok_mittal Linux - Newbie 2 01-17-2008 12:38 AM

LinuxQuestions.org > Forums > Linux Forums > Linux - Software

All times are GMT -5. The time now is 05:52 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration