Combining two outputs using AWK

Question

I have a bash command (on macOS High Sierra) as:

 sudo cat /private/var/log/system.log*| awk 'BEGIN {print "\n"} {print "Month\tDay\tTime\t\tSystemMessage"} /SHUTDOWN_TIME/{print $1,$2,$3,$8}'|sort -M|uniq|column -t

Output:

Month  Day  Time      SystemMessage
Mar    30   02:50:56  SHUTDOWN_TIME:
Mar    30   13:13:28  SHUTDOWN_TIME:
Apr    1    17:27:48  SHUTDOWN_TIME:
Apr    1    23:59:37  SHUTDOWN_TIME:
Apr    10   17:08:10  SHUTDOWN_TIME:
Apr    10   22:59:13  SHUTDOWN_TIME:
Apr    11   19:13:43  SHUTDOWN_TIME:
Apr    2    16:33:50  SHUTDOWN_TIME:
Apr    3    00:13:58  SHUTDOWN_TIME:
Apr    3    16:54:22  SHUTDOWN_TIME:
Apr    3    23:36:55  SHUTDOWN_TIME:
Apr    4    17:00:40  SHUTDOWN_TIME:
Apr    5    17:00:50  SHUTDOWN_TIME:
Apr    8    17:41:18  SHUTDOWN_TIME:
Apr    8    23:41:05  SHUTDOWN_TIME:
Apr    9    17:19:33  SHUTDOWN_TIME:
Apr    9    23:23:18  SHUTDOWN_TIME:

While I have another bash command setup as :

sudo cat /private/var/log/system.log*| awk 'BEGIN {print "\n"} {print "Month\tDay\tTime\t\tSystemMessage"} /BOOT_TIME/{print $1,$2,$3,$6}'|sort -M|uniq|column -t

Output:

Month  Day  Time      SystemMessage
Mar    30   12:37:12  BOOT_TIME
Apr    1    10:09:12  BOOT_TIME
Apr    1    21:45:41  BOOT_TIME
Apr    10   09:38:12  BOOT_TIME
Apr    10   19:53:06  BOOT_TIME
Apr    11   12:02:02  BOOT_TIME
Apr    12   09:33:21  BOOT_TIME
Apr    2    10:19:19  BOOT_TIME
Apr    2    22:54:34  BOOT_TIME
Apr    3    09:56:02  BOOT_TIME
Apr    3    21:09:25  BOOT_TIME
Apr    4    10:00:42  BOOT_TIME
Apr    5    10:09:17  BOOT_TIME
Apr    8    09:47:02  BOOT_TIME
Apr    8    21:21:34  BOOT_TIME
Apr    9    09:34:50  BOOT_TIME
Apr    9    21:16:49  BOOT_TIME

What would be the best way to combine both of these commands to produce output like this:

Month  Day  Time      SystemMessage
Mar    30   12:37:12  BOOT_TIME
Mar    30   02:50:56  SHUTDOWN_TIME

The output from the first command has a ":" at the end of each line,how can these be removed from the output?

---

Answer 1

You would probably do something like the following to combine them (untested as I don't have access to the logs on a macOS High Sierra system, and the log messages don't match at all on my Mojave system):

cat /private/var/log/system.log | awk '
    BEGIN { OFS="\t"; print "Month", "Day", "Time", "Message" }
    /SHUTDOWN_TIME/ { sub(":$","",$8); print $1, $2, $3, $8 }
    /BOOT_TIME/     {                  print $1, $2, $3, $6 }'

The sub() removes the trailing : on the 8th field if it's there.

Note that I'm only printing the header once whereas you print it once for each line. The sorting would also be unnecessary as logfiles are presumably already sorted by time.

On my macOS Mojave system, the other system.log* files are compressed, which means that you can't use cat to send their contents to awk. You would use zcat on these. As the admin user on the system, I also don't have to use sudo to read the logs.

Answer 2

Save both the output in 2 files and use below command to achieve result as mentioned

cat file1 file2|sed  '/Month/d'| sed "s/:$//g"| sed '1i Month  Day  Time      SystemMessage'

Month  Day  Time      SystemMessage
Mar    30   02:50:56  SHUTDOWN_TIME
Mar    30   13:13:28  SHUTDOWN_TIME
Apr    1    17:27:48  SHUTDOWN_TIME
Apr    1    23:59:37  SHUTDOWN_TIME
Apr    10   17:08:10  SHUTDOWN_TIME
Apr    10   22:59:13  SHUTDOWN_TIME
Apr    11   19:13:43  SHUTDOWN_TIME
Apr    2    16:33:50  SHUTDOWN_TIME
Apr    3    00:13:58  SHUTDOWN_TIME
Apr    3    16:54:22  SHUTDOWN_TIME
Apr    3    23:36:55  SHUTDOWN_TIME
Apr    4    17:00:40  SHUTDOWN_TIME
Apr    5    17:00:50  SHUTDOWN_TIME
Apr    8    17:41:18  SHUTDOWN_TIME
Apr    8    23:41:05  SHUTDOWN_TIME
Apr    9    17:19:33  SHUTDOWN_TIME
Apr    9    23:23:18  SHUTDOWN_TIME
Mar    30   12:37:12  BOOT_TIME
Apr    1    10:09:12  BOOT_TIME
Apr    1    21:45:41  BOOT_TIME
Apr    10   09:38:12  BOOT_TIME
Apr    10   19:53:06  BOOT_TIME
Apr    11   12:02:02  BOOT_TIME
Apr    12   09:33:21  BOOT_TIME
Apr    2    10:19:19  BOOT_TIME
Apr    2    22:54:34  BOOT_TIME
Apr    3    09:56:02  BOOT_TIME
Apr    3    21:09:25  BOOT_TIME
Apr    4    10:00:42  BOOT_TIME
Apr    5    10:09:17  BOOT_TIME
Apr    8    09:47:02  BOOT_TIME
Apr    8    21:21:34  BOOT_TIME
Apr    9    09:34:50  BOOT_TIME
Apr    9    21:16:49  BOOT_TIME