Date: Thu, 6 Nov 2014 18:05:54 +0000 From: Nick Wolff <nwolff@oar.net> To: Janos Dohanics <web@3dresearch.com>, FreeBSD Questions <freebsd-questions@freebsd.org> Subject: Re: uniq(1) on last field Message-ID: <D081219D.6CDE0%nwolff@oar.net> In-Reply-To: <20141106110319.eb34eaa069a4881824072010@3dresearch.com> References: <20141106110319.eb34eaa069a4881824072010@3dresearch.com>
next in thread | previous in thread | raw e-mail | index | archive | help
Janos, What do you want the final output to look like I have some ideas but am not sure exactly what your looking for. If you just want a list of file names then: "cat log | rev | cut -d=B9/=8C -f1 |rev |uniq=B2 Should give you the output you looking for. Basically you can just flip the whole string using rev(1) so the last field is now the first one. If that=B9s not what your looking for let me know a basically write scripts like this for a living so it=B9s a good thing that I enjoy the puzzles they make. =20 Nick Wolff Backbone Routing Engineer Hostmaster OARnet email: nwolff@oar.net =20 On 11/6/14, 11:03 AM, "Janos Dohanics" <web@3dresearch.com> wrote: >Hello List, > >Would you please help with a shell scripting problem. I have a samba >audit log file which after some parsing has entries like this: > >Nov 5 10:26:29 testuser 10.10.10.72 pluto pwrite ok COMMON/Solidworks >Parts & Assemblies/Filter Elements/~$Element 2-3187.SLDPRT >Nov 5 12:50:54 testuser 10.10.10.72 pluto pwrite ok COMMON/Solidworks >Parts & Assemblies/Filter Elements/~$Element 2-3187.SLDPRT >Nov 5 14:05:52 testuser 10.10.10.72 pluto pwrite ok COMMON/Solidworks >Parts & Assemblies/Filter Elements/~$Element 2-3187.SLDPRT >Nov 5 17:30:06 testuser 10.10.10.72 pluto pwrite ok COMMON/Solidworks >Parts & Assemblies/Filter Elements/~$Element 2-3187.SLDPRT >Nov 5 09:32:48 testuser 10.10.10.72 pluto pwrite ok COMMON/Solidworks >Parts & Assemblies/Gaskets/Flexitallic/10in/~$10in ANSI 600 >Flexitallic.SLDPRT >Nov 5 09:32:48 testuser 10.10.10.72 pluto pwrite ok COMMON/Solidworks >Parts & Assemblies/Gaskets/Flexitallic/20in/~$20in ANSI 600 >Flexitallic.SLDPRT >Nov 5 09:32:32 testuser 10.10.10.72 pluto pwrite ok COMMON/Solidworks >Parts & Assemblies/Lifting Lugs/~$54in Tower Lifting Lug.SLDPRT >Nov 5 10:31:29 testuser 10.10.10.72 pluto pwrite ok COMMON/Solidworks >Parts & Assemblies/CDE - Beck/Tube Baffle Coalescer Model/~$40in OD >Shell.SLDPRT >Nov 5 10:32:20 testuser 10.10.10.72 pluto pwrite ok COMMON/Solidworks >Parts & Assemblies/CDE - Beck/Tube Baffle Coalescer Model/~$40in OD >Shell.SLDPRT >Nov 5 12:54:43 testuser 10.10.10.72 pluto pwrite ok COMMON/Solidworks >Parts & Assemblies/CDE - Beck/Tube Baffle Coalescer Model/~$40in OD >Shell.SLDPRT >Nov 5 15:07:10 testuser 10.10.10.72 pluto pwrite ok COMMON/Solidworks >Parts & Assemblies/CDE - Beck/Tube Baffle Coalescer Model/~$40in OD >Shell.SLDPRT > >I would like to use uniq(1) on the file name, which is of course the >last field if / is used as field separator. > >How can I tell uniq(1) the "last field" if I have variable number of >fields? > >--=20 >Janos Dohanics >_______________________________________________ >freebsd-questions@freebsd.org mailing list >http://lists.freebsd.org/mailman/listinfo/freebsd-questions >To unsubscribe, send any mail to >"freebsd-questions-unsubscribe@freebsd.org"
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?D081219D.6CDE0%nwolff>