Question

我有以下 logfile ：

01/01/PARISService.unauthorizedcalls.2017-10-01-01.fe-paris-prod-2c-ro-74d8a8a6.us-west-2.amazon.com.gz:[Operation]getSORByID,[RemoteAddress]10.89.204.27,[ClientName]gurupa,[ApolloEnv]SellerCSWebsite/FE,[AAAClientIdentity]ApolloEnv:SellerCSWebsite/FE/Prod,[AAAClientName]CSCentral,[AuthorizedCall]true,YVEEQQ2QQBSZM8F30BQT,01 Oct 2017 01:31:39,018
01/03/PARISService.unauthorizedcalls.2017-10-01-03.fe-paris-prod-2a-ro-1b832c63.us-west-2.amazon.com.gz:[Operation]getSORByID,[RemoteAddress]10.233.102.239,[ClientName]gurupa,[ApolloEnv]SellerCSWebsite/FE,[AAAClientIdentity]ApolloEnv:SellerCSWebsite/FE/Prod,[AAAClientName]CSCentral,[AuthorizedCall]true,A5GMNC188GFREW6W2Y9C,01 Oct 2017 03:28:28,294
01/05/PARISService.unauthorizedcalls.2017-10-01-05.fe-paris-prod-2b-ro-8ba217f8.us-west-2.amazon.com.gz:[Operation]getSORByID,[RemoteAddress]10.88.153.154,[ClientName]gurupa,[ApolloEnv]SellerCSWebsite/FE,[AAAClientIdentity]ApolloEnv:SellerCSWebsite/FE/Prod,[AAAClientName]CSCentral,[AuthorizedCall]true,QKQN4AQSV5CFQ9GC0T8J,01 Oct 2017 05:09:29,257
01/07/PARISService.unauthorizedcalls.2017-10-01-07.fe-paris-prod-2b-ro-b22446dc.us-west-2.amazon.com.gz:[Operation]getSORByID,[RemoteAddress]10.89.77.133,[ClientName]gurupa,[ApolloEnv]SellerCSWebsite/FE,[AAAClientIdentity]ApolloEnv:SellerCSWebsite/FE/Prod,[AAAClientName]CSCentral,[AuthorizedCall]true,DW20Z9V06419CSX4BV4F,01 Oct 2017 07:20:37,589

我想获得仅对应3个属性的唯一条目： [ClientName] 或 [AAAClientIdentity] 或 [AAAClientName] 。

如果以上3个属性中的任何一个不同，那么对我来说这是一个唯一的条目。

任何人都可以指导我怎么做吗？

Answer 1

这个oneliner应该这样做：

awk -F, '!a[$3 FS $5 FS $6]++' file

如何在日志文件中获取唯一（3个属性）条目？

1 个答案: