1

I am trying to print a tshark command output using awk below is my command:

tshark -r "test.pcap" -odiameter.tcp.ports:"1234" -R 'diameter.cmd.code == 272 and diameter.flags.request==0 and !tcp.analysis.retransmission and diameter.flags.T == 0' -Tpdml -Tfields -ediameter.Session-Id -ediameter.CC-Request-Type -ediameter.Result-Code -ediameter.Validity-Time  -ediameter.Unit-Quota-Threshold -ediameter-Value-Digits | awk '{print $1":"$2":"$3":"$4":"$5":"$6}'

Output:

xyz.test.com:1:2001:300:400:1234

If any of the six fields is empty i want to print " " or NULL value. For example if no output is coming for 4th field, i need output as below:

 xyz.test.com:1:2001::400:1234

But i am getting output as:

xyz.test.com:1:2001:400:1234:

Any suggestions will be very useful. I am open to use any linux command to get the expected output as mentioned.

  • By awk's definition NF = number of fields. Pass it 5 fields, not 6, awk only sees five fields, thus (by definition) the LAST field is what's missing, regardless of what you say. Pass it 4 fields, the last 2 fields are missing, etc. To construct an order of 6 distinct fields, you have to evaluate each parameter (field). Host name is field 1, so run tshark to generate data for only field two and store it as a variable. Run tshark again to generate third field and store it's value in a different variable, then third run for field 4, and so on. After 5 runs, print the 6 variables on one line. – Andrew Dec 1 '15 at 17:35
1

Based on your tshark parameters, I'm guessing you are trying to output 6 specific fields, and one of them is empty. tshark by default uses a TAB character as separator, so the output will contain two consecutive TAB characters (indicating a missing value). awk however, by default treats multiple tab/spaces as one field separator - thus it doesn't do what you expect.

The solution is to specify an single field-separator character in awk.

See example, the value "4" is missing from the simulated output:

$ printf "1\t2\t3\t\t5\t6\n"
1   2   3      5  6

By default, AWK treats the two tabs as one field-separator, resulting in:

$ printf "1\t2\t3\t\t5\t6\n" \
        | awk '{print $1":"$2":"$3":"$4":"$5":"$6}'
1:2:3:5:6:

What you want is likely this:

$ printf "1\t2\t3\t\t5\t6\n" \
      | awk -v FS='\t' '{print $1":"$2":"$3":"$4":"$5":"$6}'
1:2:3::5:6

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.