Bash Shell Script to parse file

Shell Programming and Scripting
1

Raw Results:

results|192.168.2|192.168.2.1|general/udp|10287|Security Note|For your information, here is the traceroute from 192.168.2.24 to 192.168.2.1 : \n192.168.2.24\n192.168.2.1\n\n
results|192.168.2|192.168.2.1|ssh (22/tcp)|22964|Security Note|An SSH server is running on this port.\n
results|192.168.2|192.168.2.1|ssh (22/tcp)|10267|Security Note|\nSynopsis :\n\nAn SSH server is listening on this port.\n\nDescription :\n\nIt is possible to obtain information about the remote SSH\nserver by sending an empty authentication request.\n\nRisk factor :\n\nNone\n\nPlugin output :\n\nSSH version : SSH-1.99-Cisco-1.25\n\n
results|192.168.2|192.168.2.1|general/tcp|11936|Security Note|\nRemote operating system : KYOCERA Printer\nConfidence Level : 48\nMethod : SinFP\n\n \nThe remote host is running KYOCERA Printer\n
results|192.168.2|192.168.2.1|general/tcp|19506|Security Note|Information about this scan : \n\nNessus version : 3.2.1\nPlugin feed version : 200806200134\nType of plugin feed : Direct\nScanner IP : 192.168.2.24\nPort scanner(s) : nessus_tcp_scanner \nPort range : default\nThorough tests : no\nExperimental tests : no\nParanoia level : 1\nReport Verbosity : 1\nSafe checks : yes\nOptimize the test : yes\nMax hosts : 20\nMax checks : 5\nRecv timeout : 5\nScan Start Date : 2008/6/25 11:26\nScan duration : 90 sec\n\n
results|192.168.2|192.168.2.1|general/tcp|21745|Security Note|\nSynopsis :\n\nIt was not possible to log into the remote host\n\nDescription :\n\nThe credentials provided for the scan did not allow us to log into the\nremote host.\n\n\nRisk factor : \n\nNone\n\nPlugin output : \n\n- It was not possible to log into the remote host via ssh\n\n

Goal

  1. I am attempting to grab all lines beginning with 'results'
  2. Put the results in a tab format to export to excel
  3. Break up into major columns: IP address, Service, VulID number, (Security Note, hole, or Warning),
  4. Sort the file by the field 7; only allow uniq finding; and for that finding putting all IP addresses associated with it into an array and sort for unique Ip addresses and print into it's own column ($3).

Example

192.168.2.1     general/udp     10287   For your information, here is the tra
192.168.2.1     ssh (22/tcp)    22964   An SSH server is running on this port
192.168.2.1     ssh (22/tcp)    10267   Synopsis :An SSH server is listening 
192.168.2.1     general/tcp     11936   Remote operating system : KYOCERA
192.168.2.1     general/tcp     19506   Information about this scan : Nessus

However, I plan to print $3 at the end of the table. Sorry, I don't quite understand arrays.

This is what I have thus far.

gawk -F"|" '$1 == "results" { gsub(/\\n/,"", $7); printf "%s\t%s\t%s\t%s\n", $4,$5,$7, $3}' file
2 
[g]awk -F '|'  'BEGIN{OFS="\t"}
                    /^results/ {print $3, $4, $5, substr($6,1,20), $3} 0' filename | sort -t'    ' -k5 >newfile

the -t ' ' part: ' ' is a tab character typed in from the keyboard, since it is whitespace you need ' ' around it.
The trailing 0}' suppresses default printing, some awks do that.

3

Jim, thanks for your help. Do you have any suggestions on how to merge all the relevant IPs to one finding in a cell of its own. I was told that an array could be used to do so. Ex:

192.168.2.1 general/udp 10287 For your information, here is the tra
192.168.2.2
192.168.2.3

192.168.2.1 general/udp 10290 For your information, here is the tra
192.168.2.2
192.168.2.5