regex in notepad++ or sed to return two different strings

Question

I have a report that has information about a list of servers. I am wanting to search this list for uptime over a certain amount, and also the IP of the server. I have been using notepad++ to do the searching, but sed syntax would be ok too. The report has data like this:

some.dns.com
up 720 days,
some version
several lines of disk space information, between 14 and 16 lines
Connection to 10.1.1.1 closed.

some.other.dns
up 132 days,
some version
several lines of disk space information, between 14 and 16 lines
Connection to 10.1.1.2 closed.

I've come up with the following so far, which gives me the uptime threshold I need:

up ([9-9]\d|\d{3,} days,)

But I also need the IP addresses to make sense of it, and haven't been able to figure out a way to get JUST the IPs related to the servers with high uptime.

I've found something like this to find IP addresses:

((?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?\.){3}(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)))

So, I was hoping to return something like the following:

up 720 days,
10.1.1.1

Wiktor Stribiżew · Accepted Answer · 2019-06-10T22:58:54.260

0

You may actually use awk:

awk -F"\n" -v RS="" '$0 ~ /up (9[0-9]|[0-9]{3,}) days/{gsub(/Connection to | closed\./, "", $NF); print $1 "\n" $NF}' file > newfile

See the online demo

The file is read paragraph by paragraph, and fields are separated with a newline. If a record matches up (9[0-9]|[0-9]{3,}) days pattern (up with a space, then 9 followed with any digit or any 3 digits followed with space and days, then the last field ($NF) is stripped from the static text and the first and last fileds are printed.

edited Jun 10 '19 at 22:58

answered Jun 10 '19 at 22:09

Wiktor Stribiżew

607,720
39
448
563

`then Field 5 (the fifth line in the record)` may not necessarily be the 5th line. => `several lines of disk space information, between 14 and 16 lines` – maswerdna Jun 10 '19 at 22:21
@officialpsoul `$NF` is the last field, so it will work. – Wiktor Stribiżew Jun 10 '19 at 22:59
@WiktorStribiżew This isn't working for me so far, not returning anything. When I run the command, nothing is in the new file, or printed to the screen, – Chris Schneider Jun 11 '19 at 13:21
@ChrisSchneider Let's assume your file is `file.txt`. You should use `awk -F"\n" -v RS="" '$0 ~ /up (9[0-9]|[0-9]{3,}) days/{gsub(/Connection to | closed\./, "", $NF); print $1 "\n" $NF}' file.txt > result.txt`. Another variation of the same: `awk 'BEGIN {OFS=FS="\n";RS=""}; $0 ~ /up (9[0-9]|[0-9]{3,}) days/{gsub(/Connection to | closed\./, "", $NF); print $1 OFS $NF}' file.txt > result.txt` – Wiktor Stribiżew Jun 11 '19 at 13:22
I'm still testing, but inputting either statement you have provided into https://awk.js.org returns nothing, nor is it working when I run it from actual command line. I do see the online demo has it working for you. – Chris Schneider Jun 11 '19 at 13:59
I think there is a bug in awk.js.org: it does not allow range quantifiers. AWK supports POSIX ERE regex syntax by default, and should allow `[0-9]{3,}`. If your environment does not, replace it with `[0-9][0-9][0-9][0-9]*`. The `-F"\n" -v RS="" '$0 ~ /up (9[0-9]|[0-9][0-9][0-9][0-9]*) days/{gsub(/Connection to | closed\./, "", $NF); print $1 "\n" $NF}'` command works on that site. – Wiktor Stribiżew Jun 11 '19 at 14:13
@ChrisSchneider I think you have some old awk, like `nawk`, or [`mawk`](https://stackoverflow.com/q/51061467/3832970), that does not support range quantifiers. – Wiktor Stribiżew Jun 11 '19 at 14:21
It is an older version of awk for sure, at the mercy of our current version here, RHEL6, gawk 3.1.7. I will see if I can try it with something more modern - at home I have a current Arch release. – Chris Schneider Jun 11 '19 at 14:53
@WiktorStribiżew Thank you for your help, it did indeed work on a newer version, hard to account for what changes occur between different versions! The only change I had to make was changing it to $2, so" awk -F"\n" -v RS="" '$0 ~ /up (9[0-9]|[0-9]{3,}) days/{gsub(/Connection to | closed\./, "", $NF); print $2 "\n" $NF}' file > newfile marking resolved! – Chris Schneider Jun 11 '19 at 15:28
@ChrisSchneider Very glad it worked for you. Probably, you have some non-whitespace chars at the start of the lines followed with whitespaces. Since you did not share the exact file, I could only test against the small sample you shared, and SO usually normalizes some rare chars, like diacritics or unprintables. So, if you have some weird files from unknown providers, you should consider sharing part of them with us to help you quicker and more reliably. – Wiktor Stribiżew Jun 11 '19 at 19:59

regex in notepad++ or sed to return two different strings

1 Answers1