如何打印AWK搜索结果中缺少的字段？
如何打印AWK搜索结果中缺少的字段？
提问于 2015-12-24 13:54:37
我要使用AWK在Windows应用程序事件日志中搜索字符串。以下是日志摘录：
W 05-Nov-14 10:09:36 261 CA_OSC <I>Process ax_be has finished without having received an explicit termination request from the component manager </I>
Time: 5.11.2014, 10:09:36, Line: 1161, File: \MCom\src\OSS\compmgr\src/CaCompPCB.cpp, Process: CaGenericMain (2448)
E 05-Nov-14 10:09:36 17 AY_ISC An error was detected in a process that is monitored by State Manager.
Time: 5.11.2014, 10:09:36, Process: C:\AXM\Service\bin\Rep.exe_1976,
Text: (05.11.2014 10:09:36) IVS SET: CMonitorThread::ProcessTermination(AppBE,5452) A critical process has
W 05-Nov-14 10:09:37 261 CA_OSC <I>Process main_ui has finished without having received an explicit termination request from the component manager </I>
Time: 5.11.2014, 10:09:37, Line: 1161, File: \MCom\src\OSS\compmgr\src/CaCompPCB.cpp, Process: CaGenericMain (2448)我想在事件日志中搜索一个字符串"ProcessTermination“，搜索输出应该如下所示：
E 05-Nov-14 10:09:36 17 AY_ISC An error was detected in a process that is monitored by State Manager.
Time: 5.11.2014, 10:09:36, Process: C:\AXM\Service\bin\Rep.exe_1976,
Text: (05.11.2014 10:09:36) IVS SET: CMonitorThread::ProcessTermination(AppBE,5452) A critical process has即。找到匹配项时，日志和所有摘要行。搜索到的字符串可以在日志行中，也可以在任何摘要行中。每行由换行符分隔，此日志文件是一个.txt文件。
到目前为止，我已经尝试了以下命令：
awk -v RS="\n(E|I|W)" "/ProcessTermination/" XA135420_2014_11_05_AppEventLog.txt但在结果中，E|I|W丢失了。即。我得到的结果是
05-Nov-14 10:09:36 17 AY_ISC An error was detected in a process that is monitored by State Manager.
Time: 5.11.2014, 10:09:36, Process: C:\AXM\Service\bin\Rep.exe_1976,
Text: (05.11.2014 10:09:36) IVS SET: CMonitorThread::ProcessTermination(AppBE,5452) A critical process has谁能帮我在结果中列出W|E|I (日志行的第一个字段)？
注意:我在Windows7上使用的是GNU Awk 3.1.6。
Stack Overflow用户
发布于 2015-12-25 00:12:24
通过像您这样设置RS，您将从记录中删除与RS匹配的字符串，并使您的脚本特定于gawk，这都是不可取的。您可以通过保存每个RT值并在下一条记录之前打印它来解决这个问题：
$ awk -v RS='(^|\n)\\S' '/ProcessTermination/{print gensub(/^\n|\n$/,"","g",p$0)} {p=RT}' file
E 05-Nov-14 10:09:36 17 AY_ISC An error was detected in a process that is monitored by State Manager.
Time: 5.11.2014, 10:09:36, Process: C:\AXM\Service\bin\Rep.exe_1976,
Text: (05.11.2014 10:09:36) IVS SET: CMonitorThread::ProcessTermination(AppBE,5452) A critical process has由于RT是以换行符或文件开头开始的，因此必须使用gensub()来删除除第一个RS之外的每个记录所以的换行符，并删除文件中最后一个记录以其结尾的尾随换行符，因为它没有后续的RS-match来吸收其自然结束的换行符。
更清晰、更简单的解决方案不使用RT，可以在任何awk中运行：
$ cat tst.awk
/^[WEI]/ { check() }
{ buf = buf $0 RS }
END { check() }
function check() {
if ( index(buf,tgt) ) {
printf "%s", buf
}
buf = ""
}
$
$ awk -v tgt="ProcessTermination" -f tst.awk file
E 05-Nov-14 10:09:36 17 AY_ISC An error was detected in a process that is monitored by State Manager.
Time: 5.11.2014, 10:09:36, Process: C:\AXM\Service\bin\Rep.exe_1976,
Text: (05.11.2014 10:09:36) IVS SET: CMonitorThread::ProcessTermination(AppBE,5452) A critical process has注意，如果你真的想搜索一个字符串，而不是一个正则表达式，那么使用上面的index()代替/.../或match()。
页面原文内容由Stack Overflow提供。腾讯云小微IT领域专用引擎提供翻译支持
原文链接：
https://stackoverflow.com/questions/34447974
复制相关文章
相似问题
腾讯云开发者
