Field Separator

  • Use the forward slash '/' as the field separator and print the 4th field
    echo /0000:04:00.0/0000:05:05.0/0000:0b:00.0/host0/rport-0:0-1/target0:0:0/0:0:0:7 | awk -F "/" '{print $4}'

Number of Fields

These examples use the number of fields '$NF' awk variable to print certain fields
  • Print the last field, assuming a "/" as the field separator
    echo /0000:04:00.0/0000:05:05.0/0000:0b:00.0/host0/rport-0:0-1/target0:0:0/0:0:0:7 | awk -F "/" '{print $NF}'
  • Print the second to the last field, assuming a "/" as the field separator
    echo /0000:04:00.0/0000:05:05.0/0000:0b:00.0/host0/rport-0:0-1/target0:0:0/0:0:0:7 | awk -F "/" '{print $(NF-1)}'

Time Functions

These are some blurbs from the MAN page. Since one of the primary uses of AWK programs is processing log files that contain time stamp information, gawk provides the following functions for obtaining time stamps and formatting them.

Turns datespec into a time stamp of the same form as returned by systime(). The datespec is a string of the form YYYY MM DD HH MM SS DST. The contents of the string are six or seven numbers representing respectively the full year including century, the month from 1 to 12, the day of the month from 1 to 31, the hour of the day from 0 to 23, the minute from 0 to 59, and the second from 0 to 60, and an optional daylight saving flag. The values of these numbers need not be within the ranges specified; for example, an hour of -1 means 1 hour before midnight. The origin-zero Gregorian calendar is assumed, with year 0 preceding year 1 and year -1 preceding year 0. The time is assumed to be in the local timezone. If the daylight saving flag is positive, the time is assumed to be daylight saving time; if zero, the time is assumed to be standard time; and if negative (the default), mktime() attempts to determine whether daylight saving time is in effect for the specified time. If datespec does not contain enough elements or if the resulting time is out of range, mktime() returns -1.

strftime([format , timestamp])
Formats timestamp according to the specification in format. The timestamp should be of the same form as returned by systime(). If timestamp is missing, the current time of day is used. If format is missing, a default format equivalent to the output of date(1) is used. See the specification for the strftime() function in ANSI C for the format conversions that are guaranteed to be available. A public-domain version of strftime(3) and a man page for it come with gawk; if that version was used to build gawk, then all of the conversions described in that man page are available to gawk.

Returns the current time of day as the number of seconds since the Epoch (1970-01-01 00:00:00 UTC on POSIX systems).

These time functions are specifically handy for some scripting purposes, particularly with any external tools that may use EPOCH time rather than a standard date/time format. You can review the awk man page for specific syntax, these are just a few quick samples.
  • Convert a standard date/time format to EPOCH time.
    awk 'BEGIN{print mktime("2007 12 12 09 09 09")}'
    or using a variable for the time
    VAR="2007 12 12 09 09 09"
    awk -v awk_var="$VAR" 'BEGIN{print mktime(awk_var)}'
  • Convert an EPOCH time back to a standard date/time string
    awk 'BEGIN{print strftime("%c",1197479349)}'
    or using a variable for the time
    awk -v awk_var="$VAR" 'BEGIN{print strftime("%c",awk_var)}'
  • Get the current system time in EPOCH
    awk 'BEGIN{print systime()}'


  • Pass a variable to an awk function. NOTE: pay attention to the quotes, they are important
    VAR="Linux Rules!"
    awk -v awk_var="$VAR" 'BEGIN{print awk_var}'
  • Save the awk output to a variable
    MYVAR=$(echo "Hello World" | awk '{print $1}')
    echo $MYVAR
Show php error messages