1.ip地址筛选
[root@server ~]# ifconfig | awk 'BEGIN{RS="";FS="\n"}!/lo/{$0=$2;FS=" ";$0=$0;print $2}'
#这种方式先利用RS获取段落,然后通过FS分隔符为换行符获取行,这样第一行就是第一个字段,第二行为第二个字段,然后将$2赋值给$0,字段划分FS重新修改
192.168.19.135
2.插入几个新字段
[root@server ~]# echo "a b c d" | awk '{$2=$2" e f g";print}'
在abcd的b后面插入3个字段
a b e f g c d
3.文件内次数统计
4.统计TCP连接状态数量
[root@server ~]# netstat -tnap
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN 923/sshd: /usr/sbin
tcp 0 0 127.0.0.1:6010 0.0.0.0:* LISTEN 1748/sshd: root@pts
tcp 0 0 127.0.0.1:631 0.0.0.0:* LISTEN 921/cupsd
tcp 0 76 192.168.19.135:22 192.168.19.1:62787 ESTABLISHED 1724/sshd: root [pr
tcp6 0 0 ::1:6010 :::* LISTEN 1748/sshd: root@pts
tcp6 0 0 :::22 :::* LISTEN 923/sshd: /usr/sbin
tcp6 0 0 ::1:631 :::* LISTEN 921/cupsd
[root@server ~]# netstat -antp | awk '{arr[$6]++}END{for (i in arr){print arr[i], i}}'
6 LISTEN
1 ESTABLISHED
1 established)
1 Foreign
[root@server ~]# netstat -antp | grep 'tcp' | awk '{print $6}' | sort | uniq -c
1 ESTABLISHED
6 LISTEN
5.根据某字段去重(去掉uid=xxx
重复的行。 )
[root@server ~]# vim a2.txt
[root@server ~]# awk -F"?" '!arr[$2]++{print}' a2.txt
2019-01-13_12:00_index?uid=123
2019-01-13_14:00_index?uid=333
2019-01-13_15:00_index?uid=9710
a2.txt内容
2019-01-13_12:00_index?uid=123
2019-01-13_13:00_index?uid=123
2019-01-13_14:00_index?uid=333
2019-01-13_15:00_index?uid=9710
2019-01-14_12:00_index?uid=123
2019-01-14_13:00_index?uid=123
2019-01-15_14:00_index?uid=333
2019-01-16_15:00_index?uid=9710
6.处理字段缺失的数据
7.筛选某个时间段的数据
BEGIN{
# 要筛选什么时间的日志,将其时间构建成epoch值
which_time = mktime("2023 07 18 13 30 01")
}
{
# 取出日志中的日期时间字符串部分
match($0,"^.*\\[(.*)\\].*",arr)
# 将日期时间字符串转换为epoch值
tmp_time = strptime2(arr[1])
# 通过比较epoch值来比较时间大小
if(tmp_time > which_time){
print
}
}
# 构建的时间字符串格式为:"18/Jul/2023:13:30:00 +0800"
function strptime2(str,dt_str,arr,Y,M,D,H,m,S) {
dt_str = gensub("[/:+]"," ","g",str)
# dt_sr = "18 Jul 2023 13 30 00 08 00"
split(dt_str,arr," ")
Y=arr[3]
M=mon_map(arr[2])
D=arr[1]
H=arr[4]
m=arr[5]
S=arr[6]
return mktime(sprintf("%s %s %s %s %s %s",Y,M,D,H,m,S))
}
function mon_map(str,mons){
mons["Jan"]=01
mons["Feb"]=02
mons["Mar"]=03
mons["Apr"]=04
mons["May"]=05
mons["Jun"]=06
mons["Jul"]=07
mons["Aug"]=08
mons["Sep"]=09
mons["Oct"]=10
mons["Nov"]=11
mons["Dec"]=12
return mons[str]
}