Use string as Record separator in awk

Shell Programming and Scripting
1

Hello to all,

Please some help on this. I have the file in format as below.

How can I set the record separator as the string below in red
"No. Time Source Destination Protocol Length Info"

I've tried code below but it doesn't seem to work.

awk 'BEGIN{RS = "No.     Time.*"} ; {print $0}' file

input file:

No.     Time                          Source                Destination           Protocol Length Info
     28 2015-06-18 12:12:05.727772000 001822                  780568                  XXXXX  198    XXXXX

Frame 28: 198 bytes on wire (1584 bits), 198 bytes captured (1584 bits) on interface 0
    Interface id: 0 (\Device\NPF_{28086D60-7061-4ADD-B9})
    Encapsulation type: Ethernet (1)
	
	
No.     Time                          Source                Destination           Protocol Length Info
     29 2015-06-18 12:12:05.757809000 1.1.1.14          1.1.1.2          MXHHH     62     ZZZZ 

Frame 29: 62 bytes on wire (496 bits), 62 bytes captured (496 bits) on interface 0

No.     Time                          Source                Destination           Protocol Length Info
     30 2015-06-18 12:12:05.759481000 1.1.1.1          2.2.2.20           MHCKK     62     ZZZZ 

Frame 30: 62 bytes on wire (496 bits), 62 bytes captured (496 bits) on interface 0
    Interface id: 0 (\Device\NPF_{28086D60-7061-4ADD-B9A1})

Thanks for any help

2

It depends on your version of awk. Regular awk can only use a single character as RS . GNU awk and mawk can use a regular expression..

For example:

$ gawk 'BEGIN{ORS=""; RS="No.     Time[^\n]*\n"} NR==2'  file
     28 2015-06-18 12:12:05.727772000 001822                  780568                  XXXXX  198    XXXXX

Frame 28: 198 bytes on wire (1584 bits), 198 bytes captured (1584 bits) on interface 0
    Interface id: 0 (\Device\NPF_{28086D60-7061-4ADD-B9})
    Encapsulation type: Ethernet (1)


--

( I inserted the -- manually otherwise the empty lines will not print, they are not there ins the actual output )

--
Alternative way of writing it:

gawk 'NR==2' RS="No.     Time[^\n]*\n" ORS= file
3

Hello Scrutinizer,

Thanks for your reply.

I've tried your solution but I only receive the first record and if I try to print the first field for all records (28, 29 and 30), I only receive the first one (28). The same if I try to print the 2nd field(the dates) I onle receive the first date.

like this:

gawk 'BEGIN{ORS=""; RS="No.     Time[^\n]*\n"} NR==2 {print $1}' file
28

The output should be:

28
29
30

Thanks again for the help

4 
gawk 'BEGIN{ORS=""; RS="No.     Time[^\n]*\n"} NR==2 {print $1}' file

That will fail to display what you want for the two parts in red. And because record one needs to be excluded or it will display a blank line

If all you want is:

28
29
30

Try:

awk '$1 ~ /^[0-9][0-9]$/ {print $1}' file
5

Hello Aia,

Thanks for the help, but actually I want to set that string as Record Separator since each block begins with "No. ...." and I need to process further.

Thanks for any help

6

To get all the first fields, try:

gawk 'NR>1{print $1}' RS="No.     Time[^\n]*\n"  file
7

Hi Scrutinizer,

Many thanks.

Your last code it seems to work. I'll try using this was in my further analsys.

Regards