awk and uniq 3

[AIXtexas]

Hello, below is a portion of my output file:

06/13-09 55 55.012358 [**] [1 1201 7] ATTACK-RESPONSES 403 Forbidden [**] [Classification Attempted Information Leak] [Priority 2] {TCP} 168.75.35.140 80 -> 66.194.6.71 45175
06/13-09 56 08.106537 [**] [1 1201 7] ATTACK-RESPONSES 403 Forbidden [**] [Classification Attempted Information Leak] [Priority 2] {TCP} 168.75.35.140 80 -> 66.194.6.80 33904
06/13-09 55 55.012358 [**] [1 1201 7] ATTACK-RESPONSES 403 Forbidden [**] [Classification Attempted Information Leak] [Priority 2] {TCP} 168.75.35.140 80 -> 66.194.6.71 45175
06/13-09 56 08.106537 [**] [1 1201 7] ATTACK-RESPONSES 403 Forbidden [**] [Classification Attempted Information Leak] [Priority 2] {TCP} 168.75.35.140 80 -> 66.194.6.80 33904
06/13-09 55 55.012358 [**] [1 1201 7] ATTACK-RESPONSES 403 Forbidden [**] [Classification Attempted Information Leak] [Priority 2] {TCP} 168.75.35.140 80 -> 66.194.6.71 45175
06/13-09 56 08.106537 [**] [1 1201 7] ATTACK-RESPONSES 403 Forbidden [**] [Classification Attempted Information Leak] [Priority 2] {TCP} 168.75.35.140 80 -> 66.194.6.80 33904

I'm looking for the count for each IP Address and the IP Address, for example, like below:

6 66.194.6.71

The below command was my attempt, but it does not work.

cat alert | grep "ATTACK-RESPONSES" | tr ":" " " | awk '{ print ($NF-1)}' | sort | uniq -c


Thanks,
Shane

 

[p5wizard]

Try this:

cat alert | grep "ATTACK-RESPONSES" | tr ":" " " | awk '{ print $(NF-1)}' | sort | uniq -c



HTH,

p5wizard

 

[AIXtexas]

Perfect, thanks.

Shane

 

[PHV]

cat+grep+tr+awk !
awk '/ATTACK-RESPONSES/{gsub(/:/," ");print $(NF-1)}' alert | sort | uniq -c

Hope This Helps, PH.
Want to get great answers to your Tek-Tips questions? Have a look at FAQ219-2884 or FAQ181-2886

 

[vgersh99]

nawk '/ATTACK-RESPONSES/ { arr[$(NF-1)]++ } END { for (i in arr) print arr[i], i }' alert

vlad
+----------------------------+
| #include<disclaimer.h> |
+----------------------------+

 

[vgersh99]

or

nawk '/ATTACK-RESPONSES/ && arr[$(NF-1)]++ {} END { for (i in arr) print arr[i], i }' alert

vlad
+----------------------------+
| #include<disclaimer.h> |
+----------------------------+

 

[PHV]

Yes vlad, even less UUOxx !

 

[AIXtexas]

Thanks everyone!

Shane

 

[vgersh99]

I'd call it 'UUO*' - just to be politically correct.

vlad
+----------------------------+
| #include<disclaimer.h> |
+----------------------------+

 

[p5wizard]

Guys, I only corrected the placement of the '(' character... Granted, the original pipeline didn't stand a chance against you UUO* Police-Officers, but Shane was very close to getting his results by himself...

Also, depends on if you need the results 100 time an hour or just once, in which case any old "UUO*-ridden" pipeline can get the task done nicely.

Maybe TT needs an extra button on the editing box - Check for UUO* perhaps? ;-)


HTH,

p5wizard