ok so i have some code that need help
Using AWK scan file and extract the lines that have activity for the IP address 192.168.122.1
Print out 3 lines of output
a) date/time first activity on the IP address was detected b) date/time last activity on the IP address was detected c) Total number of events detected on the IP address Based on what you've said so far, something like this might work for you:
# find all lines containing the IP grep -F 192.168.122.1 FILE > tmp head -n1 tmp # print first such line tail -n1 tmp # print last such line wc -l tmp # count the number of such lines If you must use awk, here is one way:
# invoke as: # awk -f this_file.awk FILE BEGIN { count = 0 } /192\.168\.122\.1/ { if (count == 0) { print $0 # print the first line containing the IP last = $0 # in case the first line also happends to be the last count = 1 } else { count += 1 # record that another line contained the IP last = $0 # remember this line in case it ends up being the last } } END { if (count > 0) { print last # print the last line containing the IP } print count } 
