Scripting: group fields into columns

[Raynald Boucher]

Hello all,

I'm trying to write a script using an Apache access.log file as input.
As most of you know, the log is formatted like:
IPaddress, userid, time, some code, command, return code, someother code all separated by spaces.

My problem is that the command column is a quoted string containing spaces.

How can I interpret that quoted string as one single column or field?
Another way is: How can I access the second field from last?

Thanks
Raynald

[harry d brown jr]

use ''cut -d"," or in awk set the field separator to a comma FS=","

If the command has the potential for imbedded commas then extract the "IPaddress, userid, time, some code" fields first, then "count" the number of commas and extract the "return code, someother code" fields from the right.

live free or die
harry

[Kent Ostby]

I know in awk you can use something like:

$(NF-2) for the second to last field.

I'm sure you can do something similar in the shell.

What do you want the output to look like ?

[A. Clay Stephenson]

Here's one sneaky method.

awk -F\: '{print $2}' < access_log

If you have the entire input line in a shell variable; e.g. ${MYVAR} then

CMDLINE=$(echo ${MYVAR} | awk -F\" '{print $2}')
echo "Command = ${CMDLINE}"

[Kent Ostby · Accepted solution]

To follow up:

awk '{print $(NF-2);}' < ApacheFile


would print the 2nd field.

Best regards,

Kent M. Ostby

[Leif Halvarsson_2]

Hi,
Another method I have used sometimes. Pre-process the file and replace the spaces between the quotes with "_".

IFS=\"
while read a b c
do
d=$(echo $b |tr " " "_")
echo $a $d $c
done tmpfile

then you can handle this field in the tmpfile as a ordinary field.

After doing what you want it is easy to restore the original field with "echo $ |tr "_" " "

[Raynald Boucher]

Sorry for the delay answering back,

I used a combination: use second to last field $(NF-1) to tally/purge errors then split input command using FS to workfile to analyze how the application is used.

Thanks again.
Raynald