tr does the bulk work of removing spaces and changing the "|" to ",". Tr and sed are used for converting the lines grep matched into csv. Part 3: Use tr and sed to convert the records grep matched into a csv delimited file. Interval\s+\|" # Match the String "Interval" followed by 1 or more Spaces and a literal "|".įrom the tshark output, grep matched these lines: | Interval | Frames | Bytes | FRAMES | BYTES | FRAMES | BYTES | FRAMES | BYTES | | # Since this is not escaped, it is a regex OR \s+\s+ # 1 or more Spaces followed by the Characters "", then 1 or more Spaces. We need this to handle possible fractional seconds. This is the 1st set of numbers in the Interval column. With egrep, you will need to change the escaping. grep -P # The "-P" flag turns on PCRE regex matching, which is not the same as egrep. It also uses an OR to grab the header by matching the characters "Interval |". Grep will use the "Digit(s)Space(s)Space(s)" character sequence in the Interval column to match the lines with data. Once tshark produces output, we use grep with regex to extract the lines we want to save. Part 2: Extract the desired lines with grep The use of "|" as delimiters will require escaping in any regex statement that covers them.Depending on the statistic requested, there may be decimals in the data columns.When using milliseconds there will be decimals in the Interval field.Either can be used, so we will keep both and let the user decide. The Interval column gives both the time from 0 and the from the first measurement.The number of spaces in a column are variable depending on the number of digits per measurement.We want the header line, so we will use the word "Interval" followed by spaces and then a "|" character.Rows with data have a unique sequence in the Interval column of "spacespace", which we will can use for matching.Looking at this output, we can see several items to consider: | Interval | Frames | Bytes | FRAMES | BYTES | FRAMES | BYTES | FRAMES | BYTES | Here is the output when run against my test pcap file: = Tshark is run with -z io,stat at a 30 second interval, counting frames and bytes with various filters. Part 1: tshark creates the report with the data in columns Use tr and sed to convert the records grep matched into a csv delimited file.tshark creates the report with the data in columns.This answer converts multiple data columns to csv, adds rudimentary headers, accounts for decimals in fields and variable numbers of spaces. In my case, the task was to convert multiple columns of tshark io stat records with potential decimals in the data. The answers in this thread gave me the keys to solving a similar problem with tshark io stats and I wanted to share the results and how it works.
0 kommentar(er)
