Question

我正在尝试获取应用程序打印的日志数。不确定从哪里开始，我先存储所有节点：

nodes=$(awk '!a[$4]++' file)
for node in $nodes;
do
    //what logic comes here I could not manage to understand

done

示例：

Jan  2 13:01:02 node1  app1: Some message I do not care2.
Jan  2 13:01:02 node1  app2: Some message I do not care13.
Jan  2 13:01:02 node1  app3: Some message I do not care9.
Jan  2 13:01:02 node1  app4: Some message I do not care4.
Jan  2 13:01:02 node2  app4: Some message I do not care11.
Jan  2 13:01:02 node1  app4: Some message I do not care8.
Jan  2 13:01:02 node1  app2: Some message I do not care10.
Jan  2 13:01:02 node2  app1: Some message I do not care5.
Jan  2 13:01:02 node1  app2: Some message I do not care3.

预期结果：

node1:
app1:1
app2:3
app3:1
app4:2

node2:
app1:1
app4:1

Answer 1

使用GNU awk表示真正的多维数组（并假设应用程序名称和:之间始终有一个空格）：

$ awk -v OFS=':' '
    { cnt[$4][$5]++ }
    END {
        for (node in cnt) {
            print node, ""
            for (app in cnt[node]) {
                print app, cnt[node][app]
            }
            print ""
        }
    }
' file
node2:
app1:1
app4:1

node1:
app1:1
app2:3
app3:1
app4:2

如果输出顺序有问题，则可以使用多种方式订购输出，从而澄清您的要求。

Answer 2

这是gawk的排序输出版本：

awk '{a[$4][$5]++} 
     END{PROCINFO["sorted_in"] = "@ind_str_asc"
     for (e in a) {
        printf "%s:\n", e
        for (x in a[e]) 
            printf "\t%s %s\n", x, a[e][x]}}' file
node1:
    app1: 1
    app2: 3
    app3: 1
    app4: 2
node2:
    app1: 1
    app4: 1

Answer 3

排序辅助awk

$ cat monk.txt
Jan  2 13:01:02 node1  app1: Some message I do not care2.
Jan  2 13:01:02 node1  app2: Some message I do not care13.
Jan  2 13:01:02 node1  app3: Some message I do not care9.
Jan  2 13:01:02 node1  app4: Some message I do not care4.
Jan  2 13:01:02 node2  app4: Some message I do not care11.
Jan  2 13:01:02 node1  app4: Some message I do not care8.
Jan  2 13:01:02 node1  app2: Some message I do not care10.
Jan  2 13:01:02 node2  app1: Some message I do not care5.
Jan  2 13:01:02 node1  app2: Some message I do not care3.
$ sort -k4 -k5 monk.txt | awk -F"[ :]" ' { c=$7;if(p!=c && NR>1){print p;for(i in a) print "\t" i,":",a[i];delete a }p=c;a[$9]++} END{ print p;for(i in a)print "\t" i,":",a[i]; } '
node1
        app1 : 1
        app2 : 3
        app3 : 1
        app4 : 2
node2
        app1 : 1
        app4 : 1
$

或将常用打印代码包装在函数中

$ cat test.awk
function f1()
{
print p;
for(i in a) print "\t" i,":",a[i];
delete a
}
{ c=$7; if(p!=c && NR>1) { f1() } p=c;a[$9]++ }
END{ f1() }
$ sort -k4 -k5 monk.txt | gawk -F"[ :]" -f test.awk
node1
        app1 : 1
        app2 : 3
        app3 : 1
        app4 : 2
node2
        app1 : 1
        app4 : 1
$

从子组中获取每个匹配模式的数量

3 个答案: