AWK print only the lines which have dot

user_10694247 0
Viewed 215

How to print only the lines which contains dot(.) in the 5th column and remove the colon(:) at the end.

I would like to avoid repeating use of awk with | rather would love to have do all trick's with single awk

This is my command ouput with awk

$ awk '{a[$5]++;} END{for(i in a) print a[i]"  "i}' netappev.logs
4  wafl.vol.full:
5
3  sis.changelog.full:
1  17:58:41
1  using
1  "event
21  vifmgr.bcastDomainPartition:
4  wafl.mirror.access.denied:
76  secd.authsys.lookup.failed:
7  wafl.vol.runningOutOfInodes:

One way to print lines which have dot(.) only with grep:

$ awk '{a[$5]++;} END{for(i in a) print a[i]"  "i}' netappev.logs | grep \\.
4  wafl.vol.full:
3  sis.changelog.full:
21  vifmgr.bcastDomainPartition:
4  wafl.mirror.access.denied:
76  secd.authsys.lookup.failed:
7  wafl.vol.runningOutOfInodes:

removing colon(:) using | with AWK again.

$ awk '{a[$5]++;} END{for(i in a) print a[i]"  "i}' netappev.logs | grep \\. | awk -F: '{print $1}'
4  wafl.vol.full
3  sis.changelog.full
21  vifmgr.bcastDomainPartition
4  wafl.mirror.access.denied
76  secd.authsys.lookup.failed
7  wafl.vol.runningOutOfInodes

EDIT:

raw data as asked by @Ed Morton in the comment.

Last login time: 2/19/2021 17:58:41
Time                Node             Severity      Event
------------------- ---------------- ------------- ---------------------------
2/19/2021 22:32:16  ksg6007          ERROR         vifmgr.bcastDomainPartition: Broadcast domain KSGI_mgmt-38 is partitioned into 2 groups on node ksg6007. The different groups are: {a0a-38}, {e0M}. LIFs hosted on the ports in this broadcast domain may be at the risk of seeing connectivity issues.
2/19/2021 22:31:31  ksg6013          ERROR         wafl.vol.runningOutOfInodes: The file system on Volume tpv6010_ida_ipdev_workareas@vserver:577ffe3f-4d04-11e7-92cf-00a098c5e37c is using 80 percent or more of the files that can be contained on the volume.
2/19/2021 22:30:03  ksg6005          ERROR         secd.authsys.lookup.failed: Unable to retrieve credentials for UNIX user with UID (28274) on Vserver (tpv6009) for client with IP address (10.137.170.142).
2/19/2021 22:29:52  ksg6007          ERROR         secd.authsys.lookup.failed: Unable to retrieve credentials for UNIX user with UID (45509) on Vserver (tpv6011) for client with IP address (10.137.170.112).
2/19/2021 22:29:52  ksg6014          ERROR         secd.authsys.lookup.failed: Unable to retrieve credentials for UNIX user with UID (45509) on Vserver (tpv6011) for client with IP address (10.137.170.112).
2/19/2021 22:28:37  ksg6006          ERROR         vifmgr.bcastDomainPartition: Broadcast domain KSGI_mgmt-38 is partitioned into 2 groups on node ksg6006. The different groups are: {a0a-38}, {e0M}. LIFs hosted on the ports in this broadcast domain may be at the risk of seeing connectivity issues.
2/19/2021 22:28:01  ksg6008          ERROR         secd.authsys.lookup.failed: Unable to retrieve credentials for UNIX user with UID (28274) on Vserver (tpv6009) for client with IP address (10.137.170.142).
2/19/2021 22:27:15  ksg6014          ERROR         secd.authsys.lookup.failed: Unable to retrieve credentials for UNIX user with UID (46537) on Vserver (tpv6010) for client with IP address (10.137.171.26).
2/19/2021 22:27:00  ksg6005          ERROR         secd.authsys.lookup.failed: Unable to retrieve credentials for UNIX user with UID (35828) on Vserver (tpvtp605) for client with IP address (165.114.117.122).
2/19/2021 22:25:49  ksg6013          ERROR         secd.authsys.lookup.failed: Unable to retrieve credentials for UNIX user with UID (997) on Vserver (tpv6010) for client with IP address (165.114.118.231).
2/19/2021 22:24:49  ksg6005          ERROR         secd.authsys.lookup.failed: Unable to retrieve credentials for UNIX user with UID (45509) on Vserver (tpv6010) for client with IP address (10.137.170.112).
2/19/2021 22:24:49  ksg6007          ERROR         secd.authsys.lookup.failed: Unable to retrieve credentials for UNIX user with UID (45509) on Vserver (tpv6010) for client with IP address (10.137.170.112).
2/19/2021 22:24:49  ksg6008          ERROR         secd.authsys.lookup.failed: Unable to retrieve credentials for UNIX user with UID (45509) on Vserver (tpv6011) for client with IP address (10.137.170.112).
2/19/2021 22:23:49  ksg6008          ERROR         secd.authsys.lookup.failed: Unable to retrieve credentials for UNIX user with UID (46537) on Vserver (tpv6010) for client with IP address (10.137.171.26).
2/19/2021 22:23:49  ksg6013          ERROR         secd.authsys.lookup.failed: Unable to retrieve credentials for UNIX user with UID (46537) on Vserver (tpv6010) for client with IP address (10.137.171.26).
2/19/2021 22:23:47  ksg6005          ERROR         vifmgr.bcastDomainPartition: Broadcast domain KSGI_mgmt-38 is partitioned into 2 groups on node ksg6005. The different groups are: {a0a-38}, {e0M}. LIFs hosted on the ports in this broadcast domain may be at the risk of seeing connectivity issues.
2/19/2021 22:23:35  ksg6008          ERROR         vifmgr.bcastDomainPartition: Broadcast domain KSGI_mgmt-38 is partitioned into 2 groups on node ksg6008. The different groups are: {a0a-38}, {e0M}. LIFs hosted on the ports in this broadcast domain may be at the risk of seeing connectivity issues.
2/19/2021 22:22:37  ksg6007          ALERT         wafl.vol.full: Insufficient space on volume tpv6009_scratch001@vserver:41dd0809-477f-11e7-92cf-00a098c5e37c to perform operation. 8.00KB was requested but only 1.00KB was available.
2/19/2021 22:22:35  ksg6013          ERROR         secd.authsys.lookup.failed: Unable to retrieve credentials for UNIX user with UID (46329) on Vserver (tpv6009) for client with IP address (165.114.116.50).
2/19/2021 22:21:12  ksg6006          ERROR         wafl.mirror.access.denied: Access to SnapMirror volume 'tpv6010_da' was denied because SnapMirror initialization was not complete (exported Snapshot copy identifier '0' is invalid).
2/19/2021 22:21:04  ksg6014          ERROR         secd.authsys.lookup.failed: Unable to retrieve credentials for UNIX user with UID (46537) on Vserver (tpv6009) for client with IP address (165.114.118.133).
2/19/2021 22:21:02  ksg6005          ERROR         secd.authsys.lookup.failed: Unable to retrieve credentials for UNIX user with UID (46709) on Vserver (tpv6009) for client with IP address (10.137.169.63).
2/19/2021 22:21:02  ksg6005          ERROR         secd.authsys.lookup.failed: Unable to retrieve credentials for UNIX user with UID (46329) on Vserver (tpv6011) for client with IP address (10.137.170.238).
2/19/2021 22:20:58  ksg6007          ERROR         vifmgr.bcastDomainPartition: Broadcast domain KSGI_mgmt-38 is partitioned into 2 groups on node ksg6007. The different groups are: {a0a-38}, {e0M}. LIFs hosted on the ports in this broadcast domain may be at the risk of seeing connectivity issues.
2/19/2021 22:20:02  ksg6005          ERROR         secd.authsys.lookup.failed: Unable to retrieve credentials for UNIX user with UID (46329) on Vserver (tpv6010) for client with IP address (10.137.170.238).
2/19/2021 22:19:43  ksg6013          ERROR         secd.authsys.lookup.failed: Unable to retrieve credentials for UNIX user with UID (46709) on Vserver (tpv6011) for client with IP address (10.137.169.63).
2/19/2021 22:19:08  ksg6013          ERROR         secd.authsys.lookup.failed: Unable to retrieve credentials for UNIX user with UID (994) on Vserver (tpv6011) for client with IP address (165.114.116.101).
2/19/2021 22:19:02  ksg6008          ERROR         secd.authsys.lookup.failed: Unable to retrieve credentials for UNIX user with UID (45509) on Vserver (tpv6009) for client with IP address (10.137.170.112).
awk shell
4 Answers

With your shown attempts, please try following, since no samples are given so couldn't test it.

awk '{a[$5]++} END{for(i in a){if(i~/\./){print a[i]"  "i}}}' Input_file

Explanation: Basically add an additional check in your attempted program's END block to check if variable i contains dot then only print them else don't.

To handle colons(get value before 1st colon as per shown attempts) also try following then: I could have also used substitution on variable i but in case you may need to use it further so I am going with split here. Split its value with : delimiter and print very 1st value of it. This is also not considering that colon will come always in last.

awk '{a[$5]++} END{for(i in a){if(i~/\./){split(i,arr,":");print a[i]"  "arr[1]}}}' Input_file

OR with sub: As per OP's comments adding it here this variant too, considering that your colon will come always in last of values.

awk '{a[$5]++} END{for(i in a){if(i~/\./){sub(/:$/,"",i);print a[i]"  "i}}}' Input_file
user_58665800

How i can remove the line which does not contain dot(.) with.
Secondly remove the colon(:) from the every line as we see at the end.

You may try this awk:

awk -v OFS='\t' '
{
   sub(/:$/, "", $5)
   a[$5]++
}
END {
   for (i in a)
      if (index(i, "."))
         print a[i], i
}' netappev.logs
user_5482250

this should do...

awk '$5~/\./ {sub(/:$/,"",$5); a[$5]++} 
     END     {for(i in a) print a[i] "  " i}' file

removing : after the counts may yield unwanted results, assume you have text: and text, they will appear as two separate lines.

If you don't like to refer to the same field multiple times, assign to a variable at the first use.

awk '(k=$5)~/\./ {sub(/:$/,"",k); a[k]++} 
     END         {for(k in a) print a[k] "  " k}' file
user_14358690

From the block of data you posted it seems like this might be what you're trying to do but without the associated expected output it's a guess:

$ awk -F'[: ]+' 'NF>7{print $7}' file | sort | uniq -c
     20 secd.authsys.lookup.failed
      5 vifmgr.bcastDomainPartition
      1 wafl.mirror.access.denied
      1 wafl.vol.full
      1 wafl.vol.runningOutOfInodes

or if you prefer awk only:

$ awk -F'[: ]+' 'NF>7{cnt[$7]++} END{for (i in cnt) print cnt[i], i}' file
1 wafl.vol.full
5 vifmgr.bcastDomainPartition
20 secd.authsys.lookup.failed
1 wafl.mirror.access.denied
1 wafl.vol.runningOutOfInodes
user_17450010
Related