awk programming anyone?

Hi All,

I'd normally ask this type of question over on UNIX.com but their server always appears to be too busy...

I've written this piece of awk code that parses a log file. Currently it outputs two blocks of data but I'd like to combine them into one block.

The 'err' section of the log file is the error message and the awk code outputs a count of each unique error message.

There are 5 different levels of errors which are reported in field 1.

The field that I'm having trouble with is the date and time-stamp - I'd like to append the last occurrence of each unique error to the end of the line but at present I'm reporting on it separately in the second 'for' loop...

awk 'BEGIN { SUBSEP = " # " }
{
   err=substr($0,26)
        if (substr($1,5,1)==1) {
           line[1,err]++
           last[1,err] = substr($0,7,25)
        } else if (substr($1,5,1)==2) {
           line[2,err]++
           last[2,err] = substr($0,7,25)
        } else if (substr($1,5,1)==3) {
           line[3,err]++
           last[3,err] = substr($0,7,25)
        } else if (substr($1,5,1)==4) {
           line[4,err]++
           last[4,err] = substr($0,7,25)
        } else if (substr($1,5,1)==5) {
           line[5,err]++
           last[5,err] = substr($0,7,25)
        }
}
END {
    for ( i in line ) print i" # "line[i]
    print " "
    for ( n in last ) print n" # "last[n]
}'

Code (markup):

So does anyone know how I can append the date-time field ( substr($0,7,25) ) to the previous array?

Many thanks,

p.

 

I've found the solution! If anyone is interested this is the working code:

awk 'BEGIN { SUBSEP = " # " }
{
   err=substr($0,26)
        if (substr($1,5,1)==1) {
           line[1,err]++
           last[1,err] = substr($0,7,19)
        } else if (substr($1,5,1)==2) {
           line[2,err]++
           last[2,err] = substr($0,7,19)
        } else if (substr($1,5,1)==3) {
           line[3,err]++
           last[3,err] = substr($0,7,19)
        } else if (substr($1,5,1)==4) {
           line[4,err]++
           last[4,err] = substr($0,7,19)
        } else if (substr($1,5,1)==5) {
           line[5,err]++
           last[5,err] = substr($0,7,19)
        }
}
END {
    for ( i in line ) print i" # "line[i]" # "last[i]
    #print " "
    #for ( n in last ) print n" # "last[n]
}'

Code (markup):

What I found is that the addition of 'last' provides the date-time field that I'm looking for.

The 'i' in this 'for loop' is the index of the array 'line[]' which is the same format as the array last, so by calling the 'last[]' array with the same index you get it's value returned for the same index.

I love it when a plan comes together

Cheers, p.