Linux RH442 - Data formatting using AWK

Most monitoring tools present data in text format. Often, we do not need all the values provided by a given tool and instead need to extract only specific ones. So, how can we narrow down the output displayed by a monitoring tool? AWK is perfect for this task. It is an interpreted programming language whose main purpose is pattern scanning and processing in files and data streams. AWK is located in the "gawk" package. AWK is excellent for working with multi-column data, such as the output from "sar" or even a simple file listing using the "ll" command. One of the most frequently used commands with awk is "print". The "print" command is used to display selected fields from the entire output generated by the preceding command. The attribute $1 denotes the first field, $2 the second, $3 the third, and so on. The last field is represented by the argument $NF. The representation of the second-to-last field is $(NF-1), and the third-to-last is $(NF-2). The entire line is denoted by $0. The default field separators in awk are whitespace characters (spaces or tabs). Changing the separator character is done using the "-F" switch. You can learn about the awk language at this address. There is also a community surrounding awk, with a website at awk.info. It is also worth checking out this interesting tutorial: http://www.awk.of.pl/.

For example, in the /etc/passwd file, the field separator is the colon ":". If we want to use awk to display only the first column containing the usernames, the command syntax will look like this:

# awk -F: '{print $1}' /etc/passwd

root

bin

daemon

...

etc...

And how do you display the first and last columns of the /etc/passwd file?

# awk -F: '{print $1, $NF}' /etc/passwd

root /bin/bash

bin /sbin/nologin

daemon /sbin/nologin

For better readability, we can also add a header and footer to the displayed results using "printf".