查找最后一个关键字以下几行。

cbnuisve

回复 10# ljwd1000

谢谢。测试了一下用以下可用

1. $ awk '$1~/192.168.0.1$/{a=$0;s=0;next}{if(s++<3)a=a"\n"$0}END{print a}' 1
   
2. 192.168.0.1 asdfsad51
   
3. 192.168.0.5 a89e9r89
   
4. 192.168.0.6 asdfgasoiert
   
5. 192.168.0.100 asdf9wre
   
6. 
   
7. BJIT002102+Administrator@BJIT002102 ~
   
8. $ cat 1
   
9. 192.168.0.1  asdfasd sadfsd
   
10. 192.168.0.3 fdsgsiorlsf1032fdg
    
11. 192.168.0.4 dfgsdfgkoor5855
    
12. 192.168.0.1 fgiu8945rt3wwe
    
13. 192.168.0.9  98q3409r5qwer
    
14. 192.168.0.1 asdfsad51
    
15. 192.168.0.5 a89e9r89
    
16. 192.168.0.6 asdfgasoiert
    
17. 192.168.0.100 asdf9wre
    
18. 192.168.0.101 9q43258qklmtrkqwer

复制代码

但是在我正常的环境下还是有问题，我是用tshark 抓包然后读取但还是从第一行开始读取。  tshark -r ip.txt -x -V |grep -E "192.168.0.1|Time"| awk '$1~/192.168.0.1$/{a=$0;s=0;next}{if(s++<3)a=a"\n"$0}END{print a}'  

我的示例跟真实的可能有点差别。

1. Source: 192.168.0.1(192.168.0.1)
   
2.     Arrival Time: Dec 28, 2015 09:40:07.716923991 CST
   
3.     [Time shift for this packet: 0.000000000 seconds]
   
4.     Epoch Time: 1451266807.716923991 seconds
   
5.     [Time delta from previous captured frame: 0.000266969 seconds]
   
6.     [Time delta from previous displayed frame: 0.000266969 seconds]
   
7.     [Time since reference or first frame: 59821.781043467 seconds]
   
8.     Time to live: 126
   
9.     Arrival Time: Dec 28, 2015 09:40:07.749227252 CST
   
10.    。。。。。。
    

复制代码