工作中遇到个文本处理求助，awk

Auroracxy

日志格式:  时间戳(毫秒级别 除1000)|uid|id|source|status(状态有0,1,9三种)

1）中间三列$2 $3 $4组合起来代表唯一设备，只有当这个设备的status发生变化的时候则输出该行，比如持续的0变成了1；前后两条记录的时间戳差值小于60秒
2）如果某个设备前后两条记录的时间戳差值超过60秒，则插入一行信息：其中时间戳的值等于上一条记录的时间向后推10秒，status的值设置为10； 并输出下一条记录
3)  这个设备第一次出现在日志中的行 也输出出来

这样用日志举例
1409108810000|2090000199|869323003901382|adapt.a|0
1409108870000|2090000199|869323003901382|adapt.a|0
1409108880000|2090000199|869323003901382|adapt.a|1
1409108890000|2090000199|869323003901382|adapt.a|1
1409108900000|2090000199|869323003901382|adapt.a|1
1409108910000|2090000199|869323003901382|adapt.a|0
1409108810000|2090000199|860989025893705|adapt.b|0
1409108820000|2090000199|860989025893705|adapt.b|1
1409108830000|2090000199|860989025893705|adapt.b|1
1409108940000|2090000199|860989025893705|adapt.b|1
1409108950000|2090000199|860989025893705|adapt.b|0
1409108960000|2090000199|860989025893705|adapt.b|0
1409108970000|2090000199|860989025893705|adapt.b|9
1409108820000|2090000199|868145019649338|adapt.c|9
1409108830000|2090000199|868145019649338|adapt.c|9
1409108940000|2090000199|868145019649338|adapt.c|0

结果希望得到
1409108810000|2090000199|869323003901382|adapt.a|0
1409108820000|2090000199|869323003901382|adapt.a|10
1409108870000|2090000199|869323003901382|adapt.a|0
1409108880000|2090000199|869323003901382|adapt.a|1
1409108910000|2090000199|869323003901382|adapt.a|0
1409108810000|2090000199|860989025893705|adapt.b|0
1409108820000|2090000199|860989025893705|adapt.b|1
1409108840000|2090000199|860989025893705|adapt.b|10
1409108940000|2090000199|860989025893705|adapt.b|1      
1409108950000|2090000199|860989025893705|adapt.b|0
1409108970000|2090000199|860989025893705|adapt.b|9
1409108820000|2090000199|868145019649338|adapt.c|9
1409108840000|2090000199|868145019649338|adapt.c|10
1409108940000|2090000199|868145019649338|adapt.c|0

万分感谢


根据自己需求修改了一下这位朋友的答案， 结果：
awk 'BEGIN{FS=OFS="|"}{t=$2$3$4;a[t]=$1;c[t]=$5;if(b[t]==""){print $0};if(a[t]>=b[t]+60000 && b[t]!=""){x=$1;y=$5;$5=10;$1=b[t]+10000;print $0;$1=x;$5=y;print $0};if(c[t]!=d[t] && a[t]<b[t]+60000 && d[t]!=""){print $0};b[t]=a[t];d[t]=c[t]}'  urfile

chengchow

1. awk 'BEGIN{FS=OFS="|"}{a[$2$3$4]=$1;c[$2$3$4]=$5;if(a[$2$3$4]>=b[$2$3$4]+60000 && b[$2$3$4]!=""){$5=10;$1=b[$2$3$4]+10000;print $0};if(c[$2$3$4]!=d[$2$3$4] && d[$2$3$4]!=""){print $0};b[$2$3$4]=a[$2$3$4];d[$2$3$4]=c[$2$3$4]}' file
   
2. 1409108820000|2090000199|869323003901382|adapt.a|10
   
3. 1409108880000|2090000199|869323003901382|adapt.a|1
   
4. 1409108910000|2090000199|869323003901382|adapt.a|0
   
5. 1409108820000|2090000199|860989025893705|adapt.b|1
   
6. 1409108840000|2090000199|860989025893705|adapt.b|10
   
7. 1409108950000|2090000199|860989025893705|adapt.b|0
   
8. 1409108970000|2090000199|860989025893705|adapt.b|9
   
9. 1409108840000|2090000199|868145019649338|adapt.c|0
   

复制代码

上面写的有点问题，这样就可以了！

yestreenstars

给多点数据，然后给个处理结果

关阴月飞

目测一下：

1. awk -F\| '{k=$2$3$4} a[k]!=""&&a[k]!=$NF{print}  b[k]!=""&&$1-b[k]>6000{$1=b[k]+10;$NF=10;print} {a[k]=$NF;b[k]=$1}'  OFS=\| urfile

复制代码

Auroracxy

回复 2# yestreenstars


    日志已更新

chengchow

awk 'BEGIN{FS=OFS="|"}{a[$2$3$4]=$1;if(a[$2$3$4]>=b[$2$3$4]+60000 && b[$2$3$4]!=""){$5=10;$1=b[$2$3$4]+10000};b[$2$3$4]=a[$2$3$4];}!a[$2$3$4$5]++' file
1409108810000|2090000199|869323003901382|adapt.a|0
1409108820000|2090000199|869323003901382|adapt.a|10   ##条件2
1409108880000|2090000199|869323003901382|adapt.a|1
1409108810000|2090000199|860989025893705|adapt.b|0
1409108820000|2090000199|860989025893705|adapt.b|1
1409108840000|2090000199|860989025893705|adapt.b|10   ## 条件2
1409108970000|2090000199|860989025893705|adapt.b|9
1409108820000|2090000199|868145019649338|adapt.c|9
1409108840000|2090000199|868145019649338|adapt.c|0

Auroracxy

回复 5# chengchow


    您好请问结尾的
!a[$2$3$4$5]++  是什么意思呀？

chengchow

回复 6# Auroracxy
这个有问题，!a[$2$3$4$5]++
是2-3-4-5列相同的行只打印第一行，用在这里有点问题，刚才改了写法！

   

Auroracxy

回复 7# chengchow


    非常感谢 ，我先学习一下您写的

yestreenstars

回复 4# Auroracxy

骚年，how about this?

1. $ awk 'BEGIN{FS=OFS="|"}NR>1{if($2 FS $3 FS $4==b){if($1-a>=60000)print a+10000,b,10;else if($NF!=c)print}}{a=$1;b=$2 FS $3 FS $4;c=$NF}' i
   
2. 1409108820000|2090000199|869323003901382|adapt.a|10
   
3. 1409108880000|2090000199|869323003901382|adapt.a|1
   
4. 1409108910000|2090000199|869323003901382|adapt.a|0
   
5. 1409108820000|2090000199|860989025893705|adapt.b|1
   
6. 1409108840000|2090000199|860989025893705|adapt.b|10
   
7. 1409108950000|2090000199|860989025893705|adapt.b|0
   
8. 1409108970000|2090000199|860989025893705|adapt.b|9
   
9. 1409108840000|2090000199|868145019649338|adapt.c|0

复制代码