RH442攻略之awk

awk主要用于对数据按列进行处理，而sed主要针对行进行操作，两者经常被用在shell脚本中进行数据处理

输出指定列

$1代表第一列，$NF代表最后一列，$(NF-1)即倒数第二列，print表示输出结果并换行，printf表示输出结果不换行

awk '{print $1,$NF}' test    #输出test中的第一列和最后一列(命令中的逗号将被替换为空格)

-F    用于指定分割字符

awk -F: '{print $1}' /etc/passwd    #输出/etc/passwd中的第一列，即系统中的用户名

输出结果中间可以加入自定义的字符串

[root@server7 ~]# awk -F: '{print $1,"is using " $NF,"shell"}' /etc/passwd
root is using /bin/bash shell
bin is using /sbin/nologin shell
daemon is using /sbin/nologin shell
...
...
[root@server7 ~]# awk -F: '{print $1 " is using " $NF " shell"}' /etc/passwd
#将分割用空格写到字符串中，输出结果与上一条命令一致
root is using /bin/bash shell
bin is using /sbin/nologin shell
daemon is using /sbin/nologin shell
...
...

BEGIN和END可以给首行和末行加上字符串

[root@server7 ~]# awk -F: 'BEGIN{print "User List:"} {print $1} END{print "Done!"}' /etc/passwd
User List:
root
bin
...
...
student
visitor
Done!

结合其他命令使用

[root@server7 ~]# df -hP| grep -v ^Filesystem | awk 'BEGIN{print "File system state:"}{print $1,"have",$(NF-2),"available"}END{print "Done!"}'
File system state:
/dev/mapper/vgsrv-root have 1.8G available
tmpfs have 499M available
/dev/vda1 have 172M available
/dev/mapper/vgsrv-home have 226M available
Done!

awk也可以用正则表达式进行匹配

[root@server7 ~]# awk -F: '/^[a-z]*t:/{print "Username end with \"t\" is",$1}' /etc/passwd
Username end with "t" is root
Username end with "t" is halt
Username end with "t" is rtkit
Username end with "t" is abrt
Username end with "t" is student

[root@server7 ~]# awk '/^[[:alpha:][:space:]]+$/ {print}' /usr/share/doc/zip-*/README
#筛选出只有字母和空格的行[:alpha:]表示所有字母，[:space:]表示空格
are mostly identical and there is a simple procedure to convert between the
paths and names of files in other character sets to be accurately recreated
maintains backward compatibility with older archives and is mostly compliant
and Windows and DOS users will need to either convert the files as needed to
is to use zip to convert a split archive to a single file archive and then use
the encryption code was distributed separately because of the US export
automatic notification of all postings there so try one of the other methods
   Note that the above message also may actually mean you have only part
    but are not needed on ports that do not expand file paths like
   recommend you include in your product documentation an acknowledgment
   and note that the original compression sources are available at

awk用在RH442学习时，主要用于处理sar收集来的数据

[root@server7 ~]# sar -q | awk '/^[^a-z]+$/ {print $1"\t"$3}'
#取出时间和进程数两列数据
02:20:01    225
02:30:01    225
02:40:01    225
02:50:01    223
03:00:01    223
03:10:01    224
03:20:02    224
03:30:01    226
03:36:01    228