最后用 sed 和 awk 解析以創建 csv 文件

Question

因此，我正在嘗試創建一個 awk 腳本來檢查最后一個命令的輸出，以便我可以將其轉換為 csv 文件。 我遇到的問題是線路多次匹配，我不知道如何防止它發生； 而且我絕不是 awk 專家（此練習的部分原因）

sed 插入的原因是缺少“列”。

命令按摩最后一個命令並調用 awk 腳本：

last -w -F | sed -r 's/[[:space:]{23,}/ unknown /;s/(crash|down)/\1 unknown /' | awk -f awktest.awk

（作為旁注，這里的 sub 是在我決定用 sed 測試插入列之前）

awktest.awk

BEGIN { print "user,tty/pts,connection_from,login_time,state,logoff_time,total_time"}
{if ($1 ~/reboot/) {print $1","$2","$3","$4","($5" "$6" "$7" "$8" "$9)","$10","($11" "$12" "$13" "$14" "$15","$16)}}
{if ($1 ~/root/ && $2 ~/tty/) { sub($3,"null") ;  print $1","$2","$3","($4" "$5" "$6" "$7" "$8)","$9","($10","$11","$12" "$13" "$14)}}

#{if ( NF > 14) { print $1","$2","$3","($4" "$5" "$6" "$7" "$8 )","$9","($10" "$11" "$12" "$13" "$14)","$15 }}
{if ($3 == "unknown" && $11 !="unknown") { print $1","$2","$3","($4" "$5" "$6" "$7" "$8 )","$9","($10" "$11" "$12" "$13" "$14)","$15 }}
#{if ($3 == "unknown") { print $1","$2","$3","( $4" "$5" "$6" "$7" "$8 )","$9","($10","$11",")$12}}
{if ($11 == "unknown") { print $1","$2","$3","( $4" "$5" "$6" "$7" "$8 )","$9","($10","$11",")$12}}

如您所見，我嘗試了多種方法，要么有重復，要么有缺行。 重復很明顯：

root,tty2,null,Sun Jul 19 13:25:38 2020,-,down,unknown,(00:01)
root,tty2,null,Sun Jul 19 13:25:38 2020,-,down,unknown,(00:01)

是的，我知道，不漂亮； 但我正在試驗； 我被困住了，一直在閱讀 sed 和 awk 的書，瘋狂地谷歌搜索，但沒有取得任何進展； 在這一點上，我想我已經看得太久了，沒有取得任何進展。

我究竟做錯了什么？

# 為清晰起見進行編輯

（刪除了一些空格以使其更干凈）最后一個命令的示例：

root  tty3         Mon Jun  8 09:49:56 2020 - down           (00:00)
foo :0    0        Mon Jun  8 09:49:16 2020 - down                      (00:01)
reboot   system boot  5.6.16-300.fc32.x86_64 Mon Jun  8 09:48:28 2020 - Mon Jun  8 09:50:54 2020  (00:02)
roncioiu :0          Thu Jun 18 10:19:29 2020 - Thu Jun 18 10:20:19 2020  (00:00)

# 所需狀態列：

• 時間戳記為一列，因為它們在 ()

"user,tty/pts,connection_from,login_time,state,logoff_time,total_time"

Answer 1

因此，由於@tink 的溫和刺激，我最終選擇了單線並放棄了劇本。 只需要一點點數據處理。

謝謝你的提示！ 反其道而行之，我就失去理智了。

last -a -w --time-format iso | sed -r 's/\sboot\s//g;/^$/d;/wtmp/d;/(crash|down)/s/$/ unknown /' | awk 'BEGIN { print "user,pts/tty,login_time,state,logoff_time,total_time,host "} { print $1","$2","$3","$4","$5","$6","$7}'