uniq(1) on last field
Nick Wolff
nwolff at oar.net
Thu Nov 6 18:07:04 UTC 2014
Janos,
What do you want the final output to look like I have some ideas but am
not sure exactly what your looking for.
If you just want a list of file names then:
"cat log | rev | cut -d¹/Œ -f1 |rev |uniq²
Should give you the output you looking for. Basically you can just flip
the whole string using rev(1) so the last field is now the first one. If
that¹s not what your looking for let me know a basically write scripts
like this for a living so it¹s a good thing that I enjoy the puzzles they
make.
Nick Wolff
Backbone Routing Engineer
Hostmaster
OARnet
email: nwolff at oar.net
On 11/6/14, 11:03 AM, "Janos Dohanics" <web at 3dresearch.com> wrote:
>Hello List,
>
>Would you please help with a shell scripting problem. I have a samba
>audit log file which after some parsing has entries like this:
>
>Nov 5 10:26:29 testuser 10.10.10.72 pluto pwrite ok COMMON/Solidworks
>Parts & Assemblies/Filter Elements/~$Element 2-3187.SLDPRT
>Nov 5 12:50:54 testuser 10.10.10.72 pluto pwrite ok COMMON/Solidworks
>Parts & Assemblies/Filter Elements/~$Element 2-3187.SLDPRT
>Nov 5 14:05:52 testuser 10.10.10.72 pluto pwrite ok COMMON/Solidworks
>Parts & Assemblies/Filter Elements/~$Element 2-3187.SLDPRT
>Nov 5 17:30:06 testuser 10.10.10.72 pluto pwrite ok COMMON/Solidworks
>Parts & Assemblies/Filter Elements/~$Element 2-3187.SLDPRT
>Nov 5 09:32:48 testuser 10.10.10.72 pluto pwrite ok COMMON/Solidworks
>Parts & Assemblies/Gaskets/Flexitallic/10in/~$10in ANSI 600
>Flexitallic.SLDPRT
>Nov 5 09:32:48 testuser 10.10.10.72 pluto pwrite ok COMMON/Solidworks
>Parts & Assemblies/Gaskets/Flexitallic/20in/~$20in ANSI 600
>Flexitallic.SLDPRT
>Nov 5 09:32:32 testuser 10.10.10.72 pluto pwrite ok COMMON/Solidworks
>Parts & Assemblies/Lifting Lugs/~$54in Tower Lifting Lug.SLDPRT
>Nov 5 10:31:29 testuser 10.10.10.72 pluto pwrite ok COMMON/Solidworks
>Parts & Assemblies/CDE - Beck/Tube Baffle Coalescer Model/~$40in OD
>Shell.SLDPRT
>Nov 5 10:32:20 testuser 10.10.10.72 pluto pwrite ok COMMON/Solidworks
>Parts & Assemblies/CDE - Beck/Tube Baffle Coalescer Model/~$40in OD
>Shell.SLDPRT
>Nov 5 12:54:43 testuser 10.10.10.72 pluto pwrite ok COMMON/Solidworks
>Parts & Assemblies/CDE - Beck/Tube Baffle Coalescer Model/~$40in OD
>Shell.SLDPRT
>Nov 5 15:07:10 testuser 10.10.10.72 pluto pwrite ok COMMON/Solidworks
>Parts & Assemblies/CDE - Beck/Tube Baffle Coalescer Model/~$40in OD
>Shell.SLDPRT
>
>I would like to use uniq(1) on the file name, which is of course the
>last field if / is used as field separator.
>
>How can I tell uniq(1) the "last field" if I have variable number of
>fields?
>
>--
>Janos Dohanics
>_______________________________________________
>freebsd-questions at freebsd.org mailing list
>http://lists.freebsd.org/mailman/listinfo/freebsd-questions
>To unsubscribe, send any mail to
>"freebsd-questions-unsubscribe at freebsd.org"
More information about the freebsd-questions
mailing list