Why is my text file displaying all of my fields as being equal to only one field?
I am using bash to file-carve a text file with (theoretically) four fields: MD5, Timestamp, Hostname and Filepath. Each of these fields sits right above one another as shown in the output below. When I perform the following command I have output that returns 1 for every field.
awk '{print NF, "- " $1}' best_file.txt
Output:
1 - md5:XXXXXXXX
1 - timestamp:XXXXXXXX
1 - endpoint:XXXXXXXX
1 - filename:XXXXXXXX
1 - md5:XXXXXXXX
1 - timestamp:XXXXXXXX
1 - endpoint:XXXXXXXX
1 - filename:XXXXXXXX
I am trying to carve my file and organize it however I choose with those four fields. For example, when using cut
or 'awk' I cannot specify which field to cut
or awk
because it all appears as 1 field.
I would like to have the option to present MD5's and hostnames right next to each other, or filename's and timestamps side-by-side. Any help to understand why all of my fields are being presented as 1 field would be appreciated. Once again, I would expect 4, but its all showing up as one...
bash file awk field
add a comment |
I am using bash to file-carve a text file with (theoretically) four fields: MD5, Timestamp, Hostname and Filepath. Each of these fields sits right above one another as shown in the output below. When I perform the following command I have output that returns 1 for every field.
awk '{print NF, "- " $1}' best_file.txt
Output:
1 - md5:XXXXXXXX
1 - timestamp:XXXXXXXX
1 - endpoint:XXXXXXXX
1 - filename:XXXXXXXX
1 - md5:XXXXXXXX
1 - timestamp:XXXXXXXX
1 - endpoint:XXXXXXXX
1 - filename:XXXXXXXX
I am trying to carve my file and organize it however I choose with those four fields. For example, when using cut
or 'awk' I cannot specify which field to cut
or awk
because it all appears as 1 field.
I would like to have the option to present MD5's and hostnames right next to each other, or filename's and timestamps side-by-side. Any help to understand why all of my fields are being presented as 1 field would be appreciated. Once again, I would expect 4, but its all showing up as one...
bash file awk field
4
Could you please show a sample of best_file.txt
– stack0114106
Dec 31 '18 at 23:28
1
What do you mean when you say the file theoretically has 4 fields? Does it or doesn't it? In order for anyone to answer your question, you will need to include a sample of the input file, best_file.txt.
– EJK
Dec 31 '18 at 23:35
Please take a look at How to create a Minimal, Complete, and Verifiable example.
– Cyrus
Jan 1 at 0:02
You say these fields sit above each other. Fields are counted within the same row of the file.
– Barmar
Jan 1 at 1:03
add a comment |
I am using bash to file-carve a text file with (theoretically) four fields: MD5, Timestamp, Hostname and Filepath. Each of these fields sits right above one another as shown in the output below. When I perform the following command I have output that returns 1 for every field.
awk '{print NF, "- " $1}' best_file.txt
Output:
1 - md5:XXXXXXXX
1 - timestamp:XXXXXXXX
1 - endpoint:XXXXXXXX
1 - filename:XXXXXXXX
1 - md5:XXXXXXXX
1 - timestamp:XXXXXXXX
1 - endpoint:XXXXXXXX
1 - filename:XXXXXXXX
I am trying to carve my file and organize it however I choose with those four fields. For example, when using cut
or 'awk' I cannot specify which field to cut
or awk
because it all appears as 1 field.
I would like to have the option to present MD5's and hostnames right next to each other, or filename's and timestamps side-by-side. Any help to understand why all of my fields are being presented as 1 field would be appreciated. Once again, I would expect 4, but its all showing up as one...
bash file awk field
I am using bash to file-carve a text file with (theoretically) four fields: MD5, Timestamp, Hostname and Filepath. Each of these fields sits right above one another as shown in the output below. When I perform the following command I have output that returns 1 for every field.
awk '{print NF, "- " $1}' best_file.txt
Output:
1 - md5:XXXXXXXX
1 - timestamp:XXXXXXXX
1 - endpoint:XXXXXXXX
1 - filename:XXXXXXXX
1 - md5:XXXXXXXX
1 - timestamp:XXXXXXXX
1 - endpoint:XXXXXXXX
1 - filename:XXXXXXXX
I am trying to carve my file and organize it however I choose with those four fields. For example, when using cut
or 'awk' I cannot specify which field to cut
or awk
because it all appears as 1 field.
I would like to have the option to present MD5's and hostnames right next to each other, or filename's and timestamps side-by-side. Any help to understand why all of my fields are being presented as 1 field would be appreciated. Once again, I would expect 4, but its all showing up as one...
bash file awk field
bash file awk field
edited Jan 1 at 1:01
Barmar
427k36250352
427k36250352
asked Dec 31 '18 at 23:25
MaverickMaverick
12
12
4
Could you please show a sample of best_file.txt
– stack0114106
Dec 31 '18 at 23:28
1
What do you mean when you say the file theoretically has 4 fields? Does it or doesn't it? In order for anyone to answer your question, you will need to include a sample of the input file, best_file.txt.
– EJK
Dec 31 '18 at 23:35
Please take a look at How to create a Minimal, Complete, and Verifiable example.
– Cyrus
Jan 1 at 0:02
You say these fields sit above each other. Fields are counted within the same row of the file.
– Barmar
Jan 1 at 1:03
add a comment |
4
Could you please show a sample of best_file.txt
– stack0114106
Dec 31 '18 at 23:28
1
What do you mean when you say the file theoretically has 4 fields? Does it or doesn't it? In order for anyone to answer your question, you will need to include a sample of the input file, best_file.txt.
– EJK
Dec 31 '18 at 23:35
Please take a look at How to create a Minimal, Complete, and Verifiable example.
– Cyrus
Jan 1 at 0:02
You say these fields sit above each other. Fields are counted within the same row of the file.
– Barmar
Jan 1 at 1:03
4
4
Could you please show a sample of best_file.txt
– stack0114106
Dec 31 '18 at 23:28
Could you please show a sample of best_file.txt
– stack0114106
Dec 31 '18 at 23:28
1
1
What do you mean when you say the file theoretically has 4 fields? Does it or doesn't it? In order for anyone to answer your question, you will need to include a sample of the input file, best_file.txt.
– EJK
Dec 31 '18 at 23:35
What do you mean when you say the file theoretically has 4 fields? Does it or doesn't it? In order for anyone to answer your question, you will need to include a sample of the input file, best_file.txt.
– EJK
Dec 31 '18 at 23:35
Please take a look at How to create a Minimal, Complete, and Verifiable example.
– Cyrus
Jan 1 at 0:02
Please take a look at How to create a Minimal, Complete, and Verifiable example.
– Cyrus
Jan 1 at 0:02
You say these fields sit above each other. Fields are counted within the same row of the file.
– Barmar
Jan 1 at 1:03
You say these fields sit above each other. Fields are counted within the same row of the file.
– Barmar
Jan 1 at 1:03
add a comment |
1 Answer
1
active
oldest
votes
I produced analogous output with best_file.txt
containing
md5:XXXX
timestamp:XXXX
endpoint:XXXX
filename:XXXX
It is unclear whether those key names are actually in your source. For files of this sort, I do not recommend it.
Documentation on print NF
noted that the fields are space-delimited. Change the first line of that to md5 XXXX
and the corresponding output is:
2 - md5
where print NF
gives the number of fields, $1 is the first field and $2 is the second (outputs XXXX in this case). So your file only has one space-delimited field per line, which is a problem when awk runs these commands once per line (record).
If it was 'md5:XXXX timestamp:XXXX endpoint:XXXX filename:XXXX', then I could run awk '{print NF ": " $1 " " $3}' best_file.txt
to get
4: md5:XXXX endpoint:XXXX
Of course, that may not be under your control. You could:
1. Combine groups of lines into one
You can get an arbitrary number of fields on one line with awk '!(NR%4){print p " " $0, p=""}(NR%4){p=p " " $0}' best_file.txt
(requires some adjustment to get rid of the leading space; Joining two consecutive lines using awk or sed explains the commands). Then you can have a more useful input file.
2. Hunt for the lines you want
Adding more precise conditions to the second block of that snippet, you can choose which lines (fields) to remember for printing.
Both approaches fail if the source file is missing a line somewhere. Actually parsing the keys will require a good deal more logic.
add a comment |
Your Answer
StackExchange.ifUsing("editor", function () {
StackExchange.using("externalEditor", function () {
StackExchange.using("snippets", function () {
StackExchange.snippets.init();
});
});
}, "code-snippets");
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "1"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53992109%2fwhy-is-my-text-file-displaying-all-of-my-fields-as-being-equal-to-only-one-field%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
I produced analogous output with best_file.txt
containing
md5:XXXX
timestamp:XXXX
endpoint:XXXX
filename:XXXX
It is unclear whether those key names are actually in your source. For files of this sort, I do not recommend it.
Documentation on print NF
noted that the fields are space-delimited. Change the first line of that to md5 XXXX
and the corresponding output is:
2 - md5
where print NF
gives the number of fields, $1 is the first field and $2 is the second (outputs XXXX in this case). So your file only has one space-delimited field per line, which is a problem when awk runs these commands once per line (record).
If it was 'md5:XXXX timestamp:XXXX endpoint:XXXX filename:XXXX', then I could run awk '{print NF ": " $1 " " $3}' best_file.txt
to get
4: md5:XXXX endpoint:XXXX
Of course, that may not be under your control. You could:
1. Combine groups of lines into one
You can get an arbitrary number of fields on one line with awk '!(NR%4){print p " " $0, p=""}(NR%4){p=p " " $0}' best_file.txt
(requires some adjustment to get rid of the leading space; Joining two consecutive lines using awk or sed explains the commands). Then you can have a more useful input file.
2. Hunt for the lines you want
Adding more precise conditions to the second block of that snippet, you can choose which lines (fields) to remember for printing.
Both approaches fail if the source file is missing a line somewhere. Actually parsing the keys will require a good deal more logic.
add a comment |
I produced analogous output with best_file.txt
containing
md5:XXXX
timestamp:XXXX
endpoint:XXXX
filename:XXXX
It is unclear whether those key names are actually in your source. For files of this sort, I do not recommend it.
Documentation on print NF
noted that the fields are space-delimited. Change the first line of that to md5 XXXX
and the corresponding output is:
2 - md5
where print NF
gives the number of fields, $1 is the first field and $2 is the second (outputs XXXX in this case). So your file only has one space-delimited field per line, which is a problem when awk runs these commands once per line (record).
If it was 'md5:XXXX timestamp:XXXX endpoint:XXXX filename:XXXX', then I could run awk '{print NF ": " $1 " " $3}' best_file.txt
to get
4: md5:XXXX endpoint:XXXX
Of course, that may not be under your control. You could:
1. Combine groups of lines into one
You can get an arbitrary number of fields on one line with awk '!(NR%4){print p " " $0, p=""}(NR%4){p=p " " $0}' best_file.txt
(requires some adjustment to get rid of the leading space; Joining two consecutive lines using awk or sed explains the commands). Then you can have a more useful input file.
2. Hunt for the lines you want
Adding more precise conditions to the second block of that snippet, you can choose which lines (fields) to remember for printing.
Both approaches fail if the source file is missing a line somewhere. Actually parsing the keys will require a good deal more logic.
add a comment |
I produced analogous output with best_file.txt
containing
md5:XXXX
timestamp:XXXX
endpoint:XXXX
filename:XXXX
It is unclear whether those key names are actually in your source. For files of this sort, I do not recommend it.
Documentation on print NF
noted that the fields are space-delimited. Change the first line of that to md5 XXXX
and the corresponding output is:
2 - md5
where print NF
gives the number of fields, $1 is the first field and $2 is the second (outputs XXXX in this case). So your file only has one space-delimited field per line, which is a problem when awk runs these commands once per line (record).
If it was 'md5:XXXX timestamp:XXXX endpoint:XXXX filename:XXXX', then I could run awk '{print NF ": " $1 " " $3}' best_file.txt
to get
4: md5:XXXX endpoint:XXXX
Of course, that may not be under your control. You could:
1. Combine groups of lines into one
You can get an arbitrary number of fields on one line with awk '!(NR%4){print p " " $0, p=""}(NR%4){p=p " " $0}' best_file.txt
(requires some adjustment to get rid of the leading space; Joining two consecutive lines using awk or sed explains the commands). Then you can have a more useful input file.
2. Hunt for the lines you want
Adding more precise conditions to the second block of that snippet, you can choose which lines (fields) to remember for printing.
Both approaches fail if the source file is missing a line somewhere. Actually parsing the keys will require a good deal more logic.
I produced analogous output with best_file.txt
containing
md5:XXXX
timestamp:XXXX
endpoint:XXXX
filename:XXXX
It is unclear whether those key names are actually in your source. For files of this sort, I do not recommend it.
Documentation on print NF
noted that the fields are space-delimited. Change the first line of that to md5 XXXX
and the corresponding output is:
2 - md5
where print NF
gives the number of fields, $1 is the first field and $2 is the second (outputs XXXX in this case). So your file only has one space-delimited field per line, which is a problem when awk runs these commands once per line (record).
If it was 'md5:XXXX timestamp:XXXX endpoint:XXXX filename:XXXX', then I could run awk '{print NF ": " $1 " " $3}' best_file.txt
to get
4: md5:XXXX endpoint:XXXX
Of course, that may not be under your control. You could:
1. Combine groups of lines into one
You can get an arbitrary number of fields on one line with awk '!(NR%4){print p " " $0, p=""}(NR%4){p=p " " $0}' best_file.txt
(requires some adjustment to get rid of the leading space; Joining two consecutive lines using awk or sed explains the commands). Then you can have a more useful input file.
2. Hunt for the lines you want
Adding more precise conditions to the second block of that snippet, you can choose which lines (fields) to remember for printing.
Both approaches fail if the source file is missing a line somewhere. Actually parsing the keys will require a good deal more logic.
answered Jan 1 at 1:36
MBerkaMBerka
1563
1563
add a comment |
add a comment |
Thanks for contributing an answer to Stack Overflow!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53992109%2fwhy-is-my-text-file-displaying-all-of-my-fields-as-being-equal-to-only-one-field%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
4
Could you please show a sample of best_file.txt
– stack0114106
Dec 31 '18 at 23:28
1
What do you mean when you say the file theoretically has 4 fields? Does it or doesn't it? In order for anyone to answer your question, you will need to include a sample of the input file, best_file.txt.
– EJK
Dec 31 '18 at 23:35
Please take a look at How to create a Minimal, Complete, and Verifiable example.
– Cyrus
Jan 1 at 0:02
You say these fields sit above each other. Fields are counted within the same row of the file.
– Barmar
Jan 1 at 1:03