2

I have 4 fields and I want to start from last column and ignore the first 3 columns. How can I use NF in awk to do that?

root     pts/0        192.168.108.1    Mon Mar 19 08:45   still logged in
root     tty1                          Mon Mar 19 08:45   still logged in
reboot   system boot  3.10.0-693.el7.x Mon Mar 19 08:44 - 08:49  (00:04)
root     pts/0        192.168.108.1    Sun Mar 18 13:06 - crash  (19:37)
root     tty1                          Sun Mar 18 13:06 - crash  (19:38)
reboot   system boot  3.10.0-693.el7.x Sun Mar 18 13:01 - 08:49  (19:47)
root     pts/2        192.168.108.1    Sat Mar 17 12:38 - 13:09  (00:31)
root     pts/1        192.168.108.1    Sat Mar 17 10:49 - down   (02:20)
root     pts/1        192.168.108.1    Fri Mar 16 23:17 - 00:30  (01:13)
root     pts/0        192.168.108.1    Fri Mar 16 21:25 - 12:56  (15:31)
root     tty1                          Fri Mar 16 21:25 - 13:09  (15:44)
reboot   system boot  3.10.0-693.el7.x Fri Mar 16 21:04 - 13:09  (16:05)
root     pts/2        192.168.108.1    Fri Mar 16 08:45 - crash  (12:18)
root     tty1                          Fri Mar 16 08:45 - 17:25  (08:40)
syslog                                          **Never logged in**

I want to show only:

Sun Jan 19 13:52:08 -0800 2018
**Never logged in**
Fri Mar 16 08:45 - 17:25  (08:40)
Mon Mar 19 08:45   still logged in
  • If you use double space as delimiter you get the output you want: awk -F' ' '{ print $NF }' – Mikael Kjær Mar 18 '18 at 9:44
  • 1
    What are the delimiters? Tabs? If not, is there ever any whitespace in the first three columns? – Sparhawk Mar 18 '18 at 9:50
  • grep -oE '\b(Mon|Fri|Sat|Sun) +(Feb|Mar).+' – n.caillou Mar 19 '18 at 7:34
5

You could do it with a simple awk command to print the last column contents, and using a multiple spaces as the field separator. Since the default separator in awk is a single white-space, using it directly on the last column would split the contents of the last column. The NR> condition takes care of skipping the first line in applying the actual actions defined for awk.

awk -F '[[:space:]][[:space:]]+' 'NR>1{print $NF}' file

or using sed too, assuming multiple spaces between columns and column separated words only in the last column.

sed '1d;s/^.*  //' file

OP apparently re-phrased the question to dump the output of the last column command from which they wanted the last column output. Since the intermediate columns themselves could have spaces, we do a match of the column containing the day name and print from there to the end of the line i.e.

last | awk ' {
     for( i=1;i<=NF;i++ ) {
         if ( $i ~ /Mon|Tue|Wed|Thu|Fri|Sat|Sun/ ) {
             j = 0
             str = ""
             for ( j=i; j<=NF;j++ ) {
                 str = ( str ? (str FS $j):$j )
             }
             print str
             break
         }
     }
 }'
| improve this answer | |
  • @Cell-o: Is your columns separated by tabs or whitespaces? Can you post the output of hexdump -c <input-file-name> to the question – Inian Mar 19 '18 at 6:16
  • @Cell-o: See my update and see if it worked – Inian Mar 19 '18 at 7:46
0

For the original version of the question, I had liked and up-voted Inian's answer, and deleted this one, but now that the question has changed....

awk 'NR>1{if ($2~/^\*\*/) $2=foo;if ($3!~/^[[:digit:].]+$/) $3=foo; $1=$2=$3="";print}' file

The if statements should place dummy values in the second and third columns if the second is **Never or if the third isn't an IP address, but will cause the answer to fail if other funky possibilities exist...

For readability, let's re-post the one-liner since it's a bit long...

awk 'NR > 1 {
  if ( $2 ~ /^\*\*/ ) $2=foo
  if ( $3 !~ /^[[:digit:].]+$/ ) $3=foo
  $1=$2=$3=""
  print }' file
| improve this answer | |
  • @αғsнιη Quite right. It's fixable, but not without ruining its only advantage - fewer keystrokes. – user1404316 Mar 18 '18 at 12:18
  • I am getting -bash: awk NR>1{if ($3!~/[[:digit:].]+/) $3=foo; $1=$2=$3="";print}: No such file or directory – Cell-o Mar 19 '18 at 7:34
  • @Cell-o : You were too fast for me; I was still editing. Try the current version. – user1404316 Mar 19 '18 at 7:41
  • I assuming there is a small issue. when attempting run script then I am getting output like below. 3.10.0-229.el7.x Tue Sep 15 13:52 - 13:53 (00:01) Tue Sep 15 13:51 - 13:51 (00:00) Tue Sep 15 13:51 - 13:51 (00:00) 3.10.0-229.el7.x Tue Sep 15 13:46 - 13:51 (00:05) – Cell-o Mar 19 '18 at 8:43
  • I think script is not correctly catching. – Cell-o Mar 19 '18 at 8:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.