The log file is as below:-

TIME=10 sec

TIME=101 sec

TIME=29 sec

File keep going so on.


  1. Find IP where status is FAIL?
  2. Find Ave time taken by all request where status is "success"?
  3. List how many logins were via Mobile and how much time did it took ?
  • Thats just a typo.... – Machine Jan 5 '19 at 17:42
  • If the entries of the log are consistent (four lines, third being status), then you can list only the failed ones by utilising greps context line controls. e.g. grep -B2 -A1 STATUS=FAIL – steeling Jan 5 '19 at 17:51
  • @Machine Could you please clarify what you mean with "...and how much time did it took"? Do you want to know the overall time involved in Mobile-logins, successful and failed? An average? A overal or average calculation for only successful or only failed mobile logins? – ozzy Jan 5 '19 at 18:16

You're really asking 3 questions - I'll get you started with the first one, and you should make an effort to solve the other two yourself using the same basic structure (there are plenty of examples on this site for using Awk to do numerical processing such as averaging):

Use Awk in paragraph mode (by unsetting the record separator, RS), splitting the record into fields using = and \n (newline):

$ awk -vRS= -F'[=\n]' '/STATUS=FAIL/{print $4}' file.log
|improve this answer|||||
  • @Steekdriver, i need your help to understanding what u meant by unsetting the record separator, RS. – Machine Jan 8 '19 at 13:31
  • @Machine see for example 4.9 Multiple-Line Records in the GNU Awk User's Guide – steeldriver Jan 8 '19 at 13:42
  • @Steekdriver - awk -vRS= -F'[=\n]' '/STATUS=FAIL/ sum+=$8 {print sum}' test.log When doing this , i get error as below awk: /STATUS=FAIL/ sum+=$8 {print sum} awk: ^ syntax error – Machine Mar 22 '19 at 5:25
  • @Steekdriver , below is what i get when i run : awk -F '=\n' '{/Source=Mobile/a[$2] += $8} END{for (i in a) print i, a[i]}' test.log awk: {/Source=Mobile/a[$2] += $8} END{for (i in a) print i, a[i]} awk: ^ syntax error – Machine Mar 22 '19 at 5:36
  • @Machine you seem to be misunderstanding the basic rule-action structure of Awk progams - have a look at the examples here – steeldriver Mar 22 '19 at 5:46

In an unpolished version, a Bash-script could look like this, assuming that your data is contained in datafile:


printf "IPs where status is fail:\n"
grep -z -oP 'IP=\K.*\n(?=STATUS=FAIL)' datafile

printf "Avg time taken by all requests where status is 'success':\n"
grep -z -oP 'STATUS=SUCCESS\nTIME=\K\d+' datafile | \
  awk '{ total += $1; count++ } END { print ( count == 0 ? "NaN" : total/count); }'

printf "Number of logins (successful and failed) via Mobile:\n"
grep -c 'Source=Mobile' datafile

A brief elucidation:

  • Q2) Calculation of the Average time: the grep command extracts the time values (which are assumed to be all in seconds). These values are piped into the awk command, which calculates their average, and then prints that average.
|improve this answer|||||
  • @Machine What did you mean with "...and how time did they sent" ? – ozzy Jan 5 '19 at 17:56
  • can u explain what exactly u doing in second command to find Avg? – Machine Jan 5 '19 at 17:59
  • @Machine Of course, if you elucidate your question :-) – ozzy Jan 5 '19 at 18:01
  • @steeldriver Sorry. It seems I spoiled the fun... Perhaps we should leave it to Machine to figure out what the commands do precisely. Specific questions will be answered then... – ozzy Jan 5 '19 at 18:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.