Awk

Examples

get first column from mw table data

awk '/\|-/{getline;print}' /tmp/terror.txt | sed s/\|// | sed s/'^ *'// | sort -u

see who's trying to SSH into your server (brute force attack)

awk '/Invalid user/ {print $8}' /var/log/auth.log | sort | uniq -c

Docs

The man page for Awk is 27 pages long. Hard to read in a terminal. Here is

a PDF copy of the Awk manual

One-liners

HANDY ONE-LINERS FOR AWK                                  22 July 2003
compiled by Eric Pement <pemente@northpark.edu>           version 0.22
Latest version of this file is usually at:
http://www.student.northpark.edu/pemente/awk/awk1line.txt


USAGE:

Unix:  awk '/pattern/ {print "$1"}'    # standard Unix shells
DOS/Win:  awk '/pattern/ {print "$1"}'    # okay for DJGPP compiled
awk "/pattern/ {print \"$1\"}"  # required for Mingw32

Most of my experience comes from version of GNU awk (gawk) compiled for
Win32. Note in particular that DJGPP compilations permit the awk script
to follow Unix quoting syntax '/like/ {"this"}'. However, the user must
know that single quotes under DOS/Windows do not protect the redirection
arrows (<, >) nor do they protect pipes (|). Both are special symbols
for the DOS/CMD command shell and their special meaning is ignored only
if they are placed within "double quotes." Likewise, DOS/Win users must
remember that the percent sign (%) is used to mark DOS/Win environment
variables, so it must be doubled (%%) to yield a single percent sign
visible to awk.

If I am sure that a script will NOT need to be quoted in Unix, DOS, or
CMD, then I normally omit the quote marks. If an example is peculiar to
GNU awk, the command 'gawk' will be used. Please notify me if you find
errors or new commands to add to this list (total length under 65
characters). I usually try to put the shortest script first.

FILE SPACING:

# double space a file
awk '1;{print ""}'
awk 'BEGIN{ORS="\n\n"};1'

# double space a file which already has blank lines in it. Output file
# should contain no more than one blank line between lines of text.
# NOTE: On Unix systems, DOS lines which have only CRLF (\r\n) are
# often treated as non-blank, and thus 'NF' alone will return TRUE.
awk 'NF{print $0 "\n"}'

# triple space a file
awk '1;{print "\n"}'

NUMBERING AND CALCULATIONS:

# precede each line by its line number FOR THAT FILE (left alignment).
# Using a tab (\t) instead of space will preserve margins.
awk '{print FNR "\t" $0}' files*

# precede each line by its line number FOR ALL FILES TOGETHER, with tab.
awk '{print NR "\t" $0}' files*

# number each line of a file (number on left, right-aligned)
# Double the percent signs if typing from the DOS command prompt.
awk '{printf("%5d : %s\n", NR,$0)}'

# number each line of file, but only print numbers if line is not blank
# Remember caveats about Unix treatment of \r (mentioned above)
awk 'NF{$0=++a " :" $0};{print}'
awk '{print (NF? ++a " :" :"") $0}'

# count lines (emulates "wc -l")
awk 'END{print NR}'

# print the sums of the fields of every line
awk '{s=0; for (i=1; i<=NF; i++) s=s+$i; print s}'

# add all fields in all lines and print the sum
awk '{for (i=1; i<=NF; i++) s=s+$i}; END{print s}'

# print every line after replacing each field with its absolute value
awk '{for (i=1; i<=NF; i++) if ($i < 0) $i = -$i; print }'
awk '{for (i=1; i<=NF; i++) $i = ($i < 0) ? -$i : $i; print }'

# print the total number of fields ("words") in all lines
awk '{ total = total + NF }; END {print total}' file

# print the total number of lines that contain "Beth"
awk '/Beth/{n++}; END {print n+0}' file

# print the largest first field and the line that contains it
# Intended for finding the longest string in field #1
awk '$1 > max {max=$1; maxline=$0}; END{ print max, maxline}'

# print the number of fields in each line, followed by the line
awk '{ print NF ":" $0 } '

# print the last field of each line
awk '{ print $NF }'

# print the last field of the last line
awk '{ field = $NF }; END{ print field }'

# print every line with more than 4 fields
awk 'NF > 4'

# print every line where the value of the last field is > 4
awk '$NF > 4'


TEXT CONVERSION AND SUBSTITUTION:

# IN UNIX ENVIRONMENT: convert DOS newlines (CR/LF) to Unix format
awk '{sub(/\r$/,"");print}'   # assumes EACH line ends with Ctrl-M

# IN UNIX ENVIRONMENT: convert Unix newlines (LF) to DOS format
awk '{sub(/$/,"\r");print}

# IN DOS ENVIRONMENT: convert Unix newlines (LF) to DOS format
awk 1

# IN DOS ENVIRONMENT: convert DOS newlines (CR/LF) to Unix format
# Cannot be done with DOS versions of awk, other than gawk:
gawk -v BINMODE="w" '1' infile >outfile

# Use "tr" instead.
tr -d \r <infile >outfile            # GNU tr version 1.22 or higher

# delete leading whitespace (spaces, tabs) from front of each line
# aligns all text flush left
awk '{sub(/^[ \t]+/, ""); print}'

# delete trailing whitespace (spaces, tabs) from end of each line
awk '{sub(/[ \t]+$/, "");print}'

# delete BOTH leading and trailing whitespace from each line
awk '{gsub(/^[ \t]+|[ \t]+$/,"");print}'
awk '{$1=$1;print}'           # also removes extra space between fields
# This awk idiom can be used to turn command output into spreadsheet-friendly output by separating it with tabs.
# So for example, the output of the ls command: 
ls -l | awk -v OFS="\t" '$1=$1'

# insert 5 blank spaces at beginning of each line (make page offset)
awk '{sub(/^/, "     ");print}'

# align all text flush right on a 79-column width
awk '{printf "%79s\n", $0}' file*

# center all text on a 79-character width
awk '{l=length();s=int((79-l)/2); printf "%"(s+l)"s\n",$0}' file*

# substitute (find and replace) "foo" with "bar" on each line
awk '{sub(/foo/,"bar");print}'           # replaces only 1st instance
gawk '{$0=gensub(/foo/,"bar",4);print}'  # replaces only 4th instance
awk '{gsub(/foo/,"bar");print}'          # replaces ALL instances in a line

# substitute "foo" with "bar" ONLY for lines which contain "baz"
awk '/baz/{gsub(/foo/, "bar")};{print}'

# substitute "foo" with "bar" EXCEPT for lines which contain "baz"
awk '!/baz/{gsub(/foo/, "bar")};{print}'

# change "scarlet" or "ruby" or "puce" to "red"
awk '{gsub(/scarlet|ruby|puce/, "red"); print}'

# reverse order of lines (emulates "tac")
awk '{a[i++]=$0} END {for (j=i-1; j>=0;) print a[j--] }' file*

# if a line ends with a backslash, append the next line to it
# (fails if there are multiple lines ending with backslash...)
awk '/\\$/ {sub(/\\$/,""); getline t; print $0 t; next}; 1' file*

# print and sort the login names of all users
awk -F ":" '{ print $1 | "sort" }' /etc/passwd

# print the first 2 fields, in opposite order, of every line
awk '{print $2, $1}' file

# switch the first 2 fields of every line
awk '{temp = $1; $1 = $2; $2 = temp}' file

# print every line, deleting the second field of that line
awk '{ $2 = ""; print }'

# print in reverse order the fields of every line
awk '{for (i=NF; i>0; i--) printf("%s ",i);printf ("\n")}' file

# remove duplicate, consecutive lines (emulates "uniq")
awk 'a !~ $0; {a=$0}'

# remove duplicate, nonconsecutive lines
awk '! a[$0]++'                     # most concise script
awk '!($0 in a) {a[$0];print}'      # most efficient script

# concatenate every 5 lines of input, using a comma separator
# between fields
awk 'ORS=%NR%5?",":"\n"' file



SELECTIVE PRINTING OF CERTAIN LINES:

# print first 10 lines of file (emulates behavior of "head")
awk 'NR < 11'

# print first line of file (emulates "head -1")
awk 'NR>1{exit};1'

# print the last 2 lines of a file (emulates "tail -2")
awk '{y=x "\n" $0; x=$0};END{print y}'

# print the last line of a file (emulates "tail -1")
awk 'END{print}'

# print only lines which match regular expression (emulates "grep")
awk '/regex/'

# print only lines which do NOT match regex (emulates "grep -v")
awk '!/regex/'

# print the line immediately before a regex, but not the line
# containing the regex
awk '/regex/{print x};{x=$0}'
awk '/regex/{print (x=="" ? "match on line 1" : x)};{x=$0}'

# print the line immediately after a regex, but not the line
# containing the regex
awk '/regex/{getline;print}'
# someone said somewhere that getline can pose problems.... dunno exactly what/why but here's an alternate
# This prints the 5th field of the line following the regex
# Then pipes it to grep with perl-compatible regex to use look-behind and look-ahead assertions to print the contents inside parenthesis
# so given an error log that contains the following two lines (repeatedly), and you want to extract the names of the tables
# Operation failed with exitcode 3
# 12:09:54 AM Dumping wordpress (log_civicrm_extension)
awk 'f{print $5;f=0} /Operation failed with exitcode/{f=1}' /tmp/mysqldump.error.log | sort | grep -P -o '(?<=\().*(?=\))'
## Admittedly this is more complex than just a couple greps!!
# grep -A1 /Operation failed with exitcode/ /tmp/mysqldump.error.log | sort | grep -P -o '(?<=\().*(?=\))'

# grep for AAA and BBB and CCC (in any order)
awk '/AAA/; /BBB/; /CCC/'

# grep for AAA and BBB and CCC (in that order)
awk '/AAA.*BBB.*CCC/'

# print only lines of 65 characters or longer
awk 'length > 64'

# print only lines of less than 65 characters
awk 'length < 64'

# print section of file from regular expression to end of file
awk '/regex/,0'
awk '/regex/,EOF'

# print section of file based on line numbers (lines 8-12, inclusive)
awk 'NR==8,NR==12'

# print line number 52
awk 'NR==52'
awk 'NR==52 {print;exit}'          # more efficient on large files

# print section of file between two regular expressions (inclusive)
awk '/Iowa/,/Montana/'             # case sensitive


SELECTIVE DELETION OF CERTAIN LINES:

# delete ALL blank lines from a file (same as "grep '.' ")
awk NF
awk '/./'


CREDITS AND THANKS:

Special thanks to Peter S. Tillier for helping me with the first release
of this FAQ file.

For additional syntax instructions, including the way to apply editing
commands from a disk file instead of the command line, consult:

"sed & awk, 2nd Edition," by Dale Dougherty and Arnold Robbins
O'Reilly, 1997
"UNIX Text Processing," by Dale Dougherty and Tim O'Reilly
Hayden Books, 1987
"Effective awk Programming, 3rd Edition." by Arnold Robbins
O'Reilly, 2001

To fully exploit the power of awk, one must understand "regular
expressions." For detailed discussion of regular expressions, see
"Mastering Regular Expressions, 2d edition" by Jeffrey Friedl
(O'Reilly, 2002).

The manual ("man") pages on Unix systems may be helpful (try "man awk",
"man nawk", "man regexp", or the section on regular expressions in "man
ed"), but man pages are notoriously difficult. They are not written to
teach awk use or regexps to first-time users, but as a reference text
for those already acquainted with these tools.

USE OF '\t' IN awk SCRIPTS: For clarity in documentation, we have used
the expression '\t' to indicate a tab character (0x09) in the scripts.
All versions of awk, even the UNIX System 7 version should recognize
the '\t' abbreviation.

#---end of file---

Explained

Cheatsheet

http://www.catonmat.net/blog/wp-content/plugins/wp-downloadMonitor/user_uploads/awk.cheat.sheet.pdf

AWK (wp:Alfred_Aho Aho, wp:Peter_J._Weinberger Weinberger, & wp:Brian_Kernighan Kernighan) Summary

Predefined Variable Summary:

		Support:
Variable	Description	AWK	NAWK	GAWK

FS	Input Field Separator, a space by default.	Y	Y	Y
OFS	Output Field Separator, a space by default.	Y	Y	Y
NF	The Number of Fields in the current input record.	Y	Y	Y
NR	The total Number of input Records seen so far.	Y	Y	Y
RS	Record Separator, a newline by default.	Y	Y	Y
ORS	Output Record Separator, a newline by default.	Y	Y	Y
FILENAME	The name of the current input file. If no files are specified on the command line, the value of FILENAME is "-". However, FILENAME is undefined inside the BEGIN block (unless set by getline).	Y	Y	Y
ARGC	The number of command line arguments (does not include options to gawk, or the program source). Dynamically changing the contents of ARGV control the files used for data.	N	Y	Y
ARGV	Array of command line arguments. The array is indexed from 0 to ARGC - 1.	N	Y	Y
ARGIND	The index in ARGV of the current file being processed.	N	N	Y
BINMODE	On non-POSIX systems, specifies use of "binary" mode for all file I/O.Numeric values of 1, 2, or 3, specify that input files, output files, or all files, respectively, should use binary I/O. String values of "r", or "w" specify that input files, or output files, respectively, should use binary I/O. String values of "rw" or "wr" specify that all files should use binary I/O. Any other string value is treated as "rw", but generates a warning message.	N	N	Y
CONVFMT	The CONVFMT variable is used to specify the format when converting a number to a string. Default: "%.6g"	N	N	Y
ENVIRON	An array containing the values of the current environment.	N	N	Y
ERRNO	If a system error occurs either doing a redirection for getline, during a read for getline, or during a close(), then ERRNO will contain a string describing the error. The value is subject to translation in non-English locales.	N	N	Y
FIELDWIDTHS	A white-space separated list of fieldwidths. When set, gawk parses the input into fields of fixed width, instead of using the value of the FS variable as the field separator.	N	N	Y
FNR	Contains number of lines read, but is reset for each file read.	N	Y	Y
IGNORECASE	Controls the case-sensitivity of all regular expression and string operations. If IGNORECASE has a non-zero value, then string comparisons and pattern matching in rules, field splitting with FS, record separating with RS, regular expression matching with ~ and !~, and the gensub(), gsub(), index(), match(), split(), and sub() built-in functions all ignore case when doing regular expression operations. NOTE: Array subscripting is not affected. However, the asort() and asorti() functions are affected.	N	N	Y
LINT	Provides dynamic control of the --lint option from within an AWK program. When true, gawk prints lint warnings.	N	N	Y
OFMT	The default output format for numbers. Default: "%.6g"	N	Y	Y
PROCINFO	The elements of this array provide access to information about the running AWK program. PROCINFO["egid"]the value of the getegid(2) system call. PROCINFO["euid"]the value of the geteuid(2) system call. PROCINFO["FS"]"FS" if field splitting with FS is in effect,or "FIELDWIDTHS" if field splitting withFIELDWIDTHS is in effect. PROCINFO["gid"]the value of the getgid(2) system call. PROCINFO["pgrpid"]the process group ID of the current process. PROCINFO["pid"]the process ID of the current process. PROCINFO["ppid"]the parent process ID of the current process. PROCINFO["uid"]the value of the getuid(2) system call.	N	N	Y
RT	The record terminator. Gawk sets RT to the input text that matched the character or regular expression specified by RS.	N	N	Y
RSTART	The index of the first character matched by match(); 0 if no match.	N	Y	Y
RLENGTH	The length of the string matched by match(); -1 if no match.	N	Y	Y
SUBSEP	The character used to separate multiple subscripts in array elements.Default: "\034" (non-printable character, dec: 28, hex: 1C)	N	Y	Y
TEXTDOMAIN	The text domain of the AWK program; used to find the localized translations for the program's strings.	N	N	Y

� 2007 Peteris Krumins peter@catonmat.nethttp://www.catonmat.net good coders code, great reuse

Variable is supported:Y

Variable is not supported:N

Command line argument summary:

Argument	Description

-F fs--field-sepearator fs	Use fs for the input field separator (the value of the FS predefined variable).
-v var=val--assign var=val	Assign the value val to the variable var, before execution of the program begins. Such variable values are available to the BEGIN block of an AWK program.
-f program-file--file program-file	Read the AWK program source from the file program-file, instead of from the first command line argument. Multiple -f (or --file) options may be used.
-mf NNN-mr NNN	Set various memory limits to the value NNN. The f flag sets the maximum number of fields, and the r flag sets the maximum record size. (Ignored by gawk, since gawk has no pre-defined limits)
-W compat -W traditional --compat --traditional	Run in compatibility mode. In compatibility mode, gawk behaves identically to UNIX awk; none of the GNU-specific extensions are recognized.
-W copyleft -W copyright --copyleft --copyright	Print the short version of the GNU copyright information message on the standard output and exit successfully.
-W dump-variables[=file]--dump-variables[=file]	Print a sorted list of global variables, their types and final values to file. If no file is provided, gawk uses a file named awkvars.out in the current directory.
-W help -W usage --help --usage	Print a relatively short summary of the available options on the standard output.
-W lint[=value]--lint[=value]	Provide warnings about constructs that are dubious or non-portable to other AWK impl�s. With argument fatal, lint warnings become fatal errors. With an optional argument of invalid, only warnings about things that are actually invalid are issued. (This is not fully implemented yet.)
-W lint-old--lint-old	Provide warnings about constructs that are not portable to the original version of Unix awk.
-W gen-po--gen-po	Scan and parse the AWK program, and generate a GNU .po format file on standard output with entries for all localizable strings in the program. The program itself is not executed.
-W non-decimal-data--non-decimal-data	Recognize octal and hexadecimal values in input data.
-W posix--posix	This turns on compatibility mode, with the following additional restrictions: * \x escape sequences are not recognized. * Only space and tab act as field separators when FS is set to a single space, new-line does not. * You cannot continue lines after ? and :. * The synonym func for the keyword function is not recognized. * The operators and = cannot be used in place of ^ and ^=. * The fflush() function is not available.
-W profile[=prof_file]--profile[=prof_file]	Send profiling data to prof_file. The default is awkprof.out. When run with gawk, the profile is just a "pretty printed" version of the program. When run with pgawk, the profile contains execution counts of each statement in the program in the left margin and function call counts for each user-defined function.
-W re-interval--re-interval	Enable the use of interval expressions in regular expression matching. Interval expressions were not traditionally available in the AWK language.
-W source program-text--source program-text	Use program-text as AWK program source code. This option allows the easy intermixing of library functions (used via the -f and --file options) with source code entered on the command line.
-W version--version	Print version information for this particular copy of gawk on the standard output.
--	Signal the end of options. This is useful to allow further arguments to the AWK program itself to start with a "-". This is mainly for consistency with the argument parsing convention used by most other POSIX programs.