求助，文本处理需求

zimuyunren

文本内容如下： 具体需求是处理群发的账号，（from同一样账号，to不同的账号，subject=qunfa 一样的匹配出来）

from=<root@localhost.localdomain> to=<root@localhost.localdomain>[2] rcpttype=to subject=Logwatch
from=<> to=<root@localhost.localdomain>[2] rcpttype=to subject=系统退信/Mail
from=<jishu@test.com> to=<xiaoli@test.com>[2] subject=qunfa state=sent
from=<jishu@test.com> to=<xcm--1rx0thpkmnhf@test.com>[3] subject=qunfa state=ignore
from=<jishu@test.com> to=<xcm--1rx0thpe0nhf@test.com>[4] subject=qunfa state=ignore
from=<jishu@test.com> to=<linux@test.com>[5] subject=qunfa state=sent
from=<jishu@test.com> to=<jishu@test.com>[6] subject=qunfa state=sent
from=<jishu@test.com> to=<xcm--1rx0thp1z2hf@test.com>[7] subject=qunfa state=ignore
from=<jishu@test.com> to=<xcm--1rx0thpni2hf@test.com>[8] subject=qunfa state=ignore
from=<jishu@test.com> to=<aa@test.com>[9] subject=qunfa state=sent
from=<jishu@test.com> to=<xiaohua@test.com>[10] subject=qunfa state=sent
from=<jishu@test.com> to=<baoxiao@test.com>[11] subject=qunfa state=sent
from=<jishu@test.com> to=<yunwei@test.com>[12] subject=qunfa state=sent
from=<jishu@test.com> to=<java@test.com>[13] subject=qunfa state=sent
from=<jishu@test.com> to=<kaifa@test.com>[14] subject=qunfa state=sent
from=<jishu@test.com> to=<12345678@qq.com>[2] rcpttype=to subject=qqyouxiang
from=<> to=<jishu@test.com>[2] subject=系统退信/Mail Delivery

yestreenstars

目测：

1. [root@localhost ~]# awk '{a[$1$3]=a[$1$3]?a[$1$3] RS $0:$0;b[$1$3]++}END{for(i in a)if(b[i]>1)print a[i]}' i
   
2. from=<jishu@test.com> to=<xiaoli@test.com>[2] subject=qunfa state=sent
   
3. from=<jishu@test.com> to=<xcm--1rx0thpkmnhf@test.com>[3] subject=qunfa state=ignore
   
4. from=<jishu@test.com> to=<xcm--1rx0thpe0nhf@test.com>[4] subject=qunfa state=ignore
   
5. from=<jishu@test.com> to=<linux@test.com>[5] subject=qunfa state=sent
   
6. from=<jishu@test.com> to=<jishu@test.com>[6] subject=qunfa state=sent
   
7. from=<jishu@test.com> to=<xcm--1rx0thp1z2hf@test.com>[7] subject=qunfa state=ignore
   
8. from=<jishu@test.com> to=<xcm--1rx0thpni2hf@test.com>[8] subject=qunfa state=ignore
   
9. from=<jishu@test.com> to=<aa@test.com>[9] subject=qunfa state=sent
   
10. from=<jishu@test.com> to=<xiaohua@test.com>[10] subject=qunfa state=sent
    
11. from=<jishu@test.com> to=<baoxiao@test.com>[11] subject=qunfa state=sent
    
12. from=<jishu@test.com> to=<yunwei@test.com>[12] subject=qunfa state=sent
    
13. from=<jishu@test.com> to=<java@test.com>[13] subject=qunfa state=sent
    
14. from=<jishu@test.com> to=<kaifa@test.com>[14] subject=qunfa state=sent
    
15. [root@localhost ~]#

复制代码

zimuyunren

就是这个意思，谢谢帮忙 小弟愚钝，有点看不懂，呵呵回复 2# yestreenstars


   

yestreenstars

回复 3# zimuyunren
等你有基础之后再回头来看就会发现其实很简单~

   

Herowinter

回复 4# yestreenstars
按照个人的理解是，把from和subject相同的行存入数组a中，若这样的行超过1次，
判断为群发邮件，不同的群发行以RS分隔。

   

LikeLx

回复 2# yestreenstars
我这么写 awk -F '[><]' '/subject=qunfa/&&a[$2]++&&!b[$4]++' 为什么from=<jishu@test.com> to=<xiaoli@test.com>[2] subject=qunfa state=sent这条记录打印不出来？请高手指点下

   

LikeLx

回复 2# yestreenstars
大神我用
from=<root@localhost.localdomain> to=<root@localhost.localdomain>[2] rcpttype=to subject=Logwatch
from=<root@localhost.localdomain> to=<root@localhost.localdomain>[16] rcpttype=to subject=系统退信/Mail
这样的文件 你的代码也把它输出来了！

   

yestreenstars

回复 6# LikeLx
因为处理这行时a[$2]++为假~

   

yestreenstars

回复 7# LikeLx
改成这样了：

1. awk '{s=gensub(/.*(subject=[^ ]*).*/,"\\1",1);t=$1""s;a[t]=a[t]?a[t] RS $0:$0;b[t]++}END{for(i in a)if(b[i]>1)print a[i]}'

复制代码

LikeLx

回复 9# yestreenstars

这个OK