我有以下两个文件。
第一个文件是:
3184 2014-07-28 04:15 global.Remote-Access 10.111.8.25 81.245.6.25 tcp
3268
3035 2014-07-28 04:16 global.Remote-Access 10.111.8.12 81.245.6.25 tcp
3268
第二个文件是:
1 Jul 28 04:12 2014-07-28 id967254(group3)[attribute1 attribute2]
Tunneling: User with IP 10.111.8.12 10 connected
1 Jul 28 04:15 2014-07-28 id920767(group2)[attribute3 attribute4 ....
attribute n] Tunneling: User with IP 10.111.8.25 connected
1 Jul 28 04:16 2014-07-28 ID926072(group3)[attribute1 attribute2]
Tunneling:User with IP 10.111.8.12 connected
如果文件 1 中的源 IP 地址等于文件 2 ,并且文件 1 中的时间 ( hh:mm
) 和日期 ( yyyy-mm-dd
) 等于文件 2 ,则第三个文件将如下:
3184 04:15 2014-07-28 global.Remote-Access id920767(group2)[attribute3
attribute4 .... attribute n] 10.111.8.25 81.245.6.25 tcp 3268
3035 04:16 2014-07-28 global.Remote-Access ID926072(group3)[attribute1
attribute2] 10.111.8.12 81.245.6.25 tcp 3268
我如何使用 来实现这一点awk
?
答案1
尝试这个:
$ awk 'FNR==NR{a[$2$3$5];next} ($5$4$(NF-1)) in a' file1 file2
1 Jul 28 04:15 2014-07-28 id920767(group2)[attribute3 attribute4 .... attribute n] Tunneling: User with IP 10.111.8.25 connected
1 Jul 28 04:16 2014-07-28 ID926072(group3)[attribute1 attribute2] Tunneling:User with IP 10.111.8.12 connected
答案2
awk 'NR == FNR {t=($4 $5 $(NF-1));
$1=$2=$3=$4=$5=X;
$0=$0; $1=$1;
sub(/].*$/, "]");
a[t] = $0; next}
($3 $2 $5) in a {$4 = ($4 " " a[$3 $2 $5])}1' file2 file1