Date: Thu, 6 Nov 2014 11:03:19 -0500 From: Janos Dohanics <web@3dresearch.com> To: FreeBSD Questions <freebsd-questions@freebsd.org> Subject: uniq(1) on last field Message-ID: <20141106110319.eb34eaa069a4881824072010@3dresearch.com>
next in thread | raw e-mail | index | archive | help
Hello List, Would you please help with a shell scripting problem. I have a samba audit log file which after some parsing has entries like this: Nov 5 10:26:29 testuser 10.10.10.72 pluto pwrite ok COMMON/Solidworks Parts & Assemblies/Filter Elements/~$Element 2-3187.SLDPRT Nov 5 12:50:54 testuser 10.10.10.72 pluto pwrite ok COMMON/Solidworks Parts & Assemblies/Filter Elements/~$Element 2-3187.SLDPRT Nov 5 14:05:52 testuser 10.10.10.72 pluto pwrite ok COMMON/Solidworks Parts & Assemblies/Filter Elements/~$Element 2-3187.SLDPRT Nov 5 17:30:06 testuser 10.10.10.72 pluto pwrite ok COMMON/Solidworks Parts & Assemblies/Filter Elements/~$Element 2-3187.SLDPRT Nov 5 09:32:48 testuser 10.10.10.72 pluto pwrite ok COMMON/Solidworks Parts & Assemblies/Gaskets/Flexitallic/10in/~$10in ANSI 600 Flexitallic.SLDPRT Nov 5 09:32:48 testuser 10.10.10.72 pluto pwrite ok COMMON/Solidworks Parts & Assemblies/Gaskets/Flexitallic/20in/~$20in ANSI 600 Flexitallic.SLDPRT Nov 5 09:32:32 testuser 10.10.10.72 pluto pwrite ok COMMON/Solidworks Parts & Assemblies/Lifting Lugs/~$54in Tower Lifting Lug.SLDPRT Nov 5 10:31:29 testuser 10.10.10.72 pluto pwrite ok COMMON/Solidworks Parts & Assemblies/CDE - Beck/Tube Baffle Coalescer Model/~$40in OD Shell.SLDPRT Nov 5 10:32:20 testuser 10.10.10.72 pluto pwrite ok COMMON/Solidworks Parts & Assemblies/CDE - Beck/Tube Baffle Coalescer Model/~$40in OD Shell.SLDPRT Nov 5 12:54:43 testuser 10.10.10.72 pluto pwrite ok COMMON/Solidworks Parts & Assemblies/CDE - Beck/Tube Baffle Coalescer Model/~$40in OD Shell.SLDPRT Nov 5 15:07:10 testuser 10.10.10.72 pluto pwrite ok COMMON/Solidworks Parts & Assemblies/CDE - Beck/Tube Baffle Coalescer Model/~$40in OD Shell.SLDPRT I would like to use uniq(1) on the file name, which is of course the last field if / is used as field separator. How can I tell uniq(1) the "last field" if I have variable number of fields? -- Janos Dohanics
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20141106110319.eb34eaa069a4881824072010>