sed multiple lines print tab separated

I would like to use sed to extract index number, username, IP address, and last use elapsed time from a command output which looks like this:

smb:usersArray:_array_index:5:lastUseElapsedTime = 214
smb:usersArray:_array_index:5:minsToDisconnect = 0
smb:usersArray:_array_index:5:sessionType = "tcp"
smb:usersArray:_array_index:5:serviceType = "smb"
smb:usersArray:_array_index:5:ipAddress = "192.168.168.1"
smb:usersArray:_array_index:5:sessionID = 9188440707059155379
smb:usersArray:_array_index:5:loginElapsedTime = 3897
smb:usersArray:_array_index:5:disconnectID = 9188440707059155379
smb:usersArray:_array_index:5:name = "DOMAIN\username1"
smb:usersArray:_array_index:5:flags = 0
smb:usersArray:_array_index:6:lastUseElapsedTime = 3772
smb:usersArray:_array_index:6:minsToDisconnect = 0
smb:usersArray:_array_index:6:sessionType = "tcp"
smb:usersArray:_array_index:6:serviceType = "smb"
smb:usersArray:_array_index:6:ipAddress = "192.168.168.2"
smb:usersArray:_array_index:6:sessionID = 9188440707059155380
smb:usersArray:_array_index:6:loginElapsedTime = 3783
smb:usersArray:_array_index:6:disconnectID = 9188440707059155380
smb:usersArray:_array_index:6:name = "DOMAIN\username2"
smb:usersArray:_array_index:6:flags = 0

...and print a tab separated output like this:

5<tab>192.168.168.1<tab>username1<tab>214
6<tab>192.168.168.2<tab>username2<tab>3772
....

How can I achieve that?

1 answer

  • answered 2018-11-08 09:28 Corentin Limier

    awk to the rescue

    awk -F":| = " '{gsub(/"/,"");gsub(/DOMAIN\\/, "")};$5~/ipAddress/{ip[$4]=$6} $5~/name/{name[$4]=$6} $5~/lastUseElapsedTime/{time[$4]=$6} END{for(e in time){print e, ip[e], name[e], time[e]}}' OFS="\t" file
    

    Or by simulating multi-dimensional arrays :

    awk -F":| = " '{gsub(/"/,"");gsub(/DOMAIN\\/, "")}{id[$4]=1;r[$4 $5]=$6}END{for(e in id){print e, r[e "ipAddress"], r[e "name"], r[e "lastUseElapsedTime"]}}' OFS="\t" file
    

    (would love to use this: https://www.gnu.org/software/gawk/manual/html_node/Arrays-of-Arrays.html but doesn't work on my awk version)

    Output :

    5   192.168.168.1   username1   214
    6   192.168.168.2   username2   3772