awk处理文本的问题

mwl326

文本格式如下：

WARNING: 03-19 10:00:00:  XXX. * 1126189408 [xxxxxxxxx.cpp] [check_item] : socket 74 closed by peer.
WARNING: 03-19 10:00:00:  XXX. * 1231087968 read [src] from xxxxxui fail
WARNING: 03-19 10:00:00:  XXX * 1231087968 read [dt] from xxxxxxui fail
WARNING: 03-19 10:00:00:  XXX * 1524803936 [xxxxxxx.cpp] [xxxxxxx] : areaID is zero
WARNING: 03-19 10:00:00:  XXX * 1598232928 read [xxxxx] from mcpackof ui fail
ERROR: 03-19 10:00:00:  XXX * 1598232928 read [xxxxx] from mcpackof ui fail
WARNING: 03-19 10:00:00:  XXX * 1472354656 [xxxxxxx.cpp] [get_provinceID] : areaID is zero
WARNING: 03-19 10:00:00:  XXX * 1650682208 [xxxxxxx.cpp] [get_provinceID] : areaID is zero
FATAL: 03-19 10:00:00:  XXX * 1430395232 [xxxxxxxx.cpp] [get_provinceID] : areaID is zero
WARNING: 03-19 10:00:00:  XXX * 1335986528 [xxxxxxxx.cpp] [get_provinceID] : areaID is zero

我想用第一列和具体的日志内容作为key 统计对应的数值。
比如
处理后得到：
data【WARNING】【[xxxxxxxxx.cpp] [check_item] : socket 74 closed by peer.】 有多少个， 以此类推。

谢谢~~

yestreenstars

1. sed -r 's/^([^:]*).*[0-9]{10} (.*)$/data【\1】【\2】/'

复制代码

mwl326

回复 2# yestreenstars

谢谢 但是我想用awk获取一个统计数值。


   

mwl326

回复 2# yestreenstars

就是我想遍历一次文件就可以做到。


   

rdcwayx

1. awk '{printf $2 FS $1 ;for (i=7;i<=NF;i++) printf FS $i;printf RS}' input|sort |uniq -c |sort -n

复制代码

yestreenstars

这样可以吗？

1. awk '{for(i=7;i<=NF;i++)s=s?s" "$i:$i;a[$1,s]++;s=""}END{for(i in a)print a[i],i}'

复制代码

good_luck_68

# sed  -r 's/03-19.*[0-9]{3,}//' file | sort -nr | uniq -c
      1 WARNING:  read [xxxxx] from mcpackof ui fail
      1 WARNING:  read [src] from xxxxxui fail
      1 WARNING:  read [dt] from xxxxxxui fail
      1 WARNING:  [xxxxxxxxx.cpp] [check_item] : socket 74 closed by peer.
      1 WARNING:  [xxxxxxxx.cpp] [get_provinceID] : areaID is zero
      1 WARNING:  [xxxxxxx.cpp] [xxxxxxx] : areaID is zero
      2 WARNING:  [xxxxxxx.cpp] [get_provinceID] : areaID is zero
      1 FATAL:  [xxxxxxxx.cpp] [get_provinceID] : areaID is zero
      1 ERROR:  read [xxxxx] from mcpackof ui fail

mwl326

回复 6# yestreenstars


    谢谢你~~~