A field is named product. I want to produce a list of products in my source, which are not made up of only english alphanumeric characters (any length). I.e. Products: Dog Collar 18 inch Dog Collar 20-inch Dog Collar Ƨhock collar would yield only: 20-inch Dog Collar Ƨhock collar (Because of the latin character and the hyphen.) I've seen plenty of uses of sed to remove/replace the non-alphanumerics, but I don't want to remove, just get a list of the outliers. ... View more

I'm working with email response data which comes into my index in individual messages. Each email message can have more than 100 entries in the index. I'm trying to build tables to make the data easy to read. This is what some simplified and sanitized results from my search look like: [01:00:22.164297] x=ABC mod=mail cmd=msg rule=ruleQ subject="Test 123" size=8583 [01:00:22.136496] x=ABC mod=spam cmd=run rule=notspam [01:00:22.106325] x=ABC mod=spam cmd=run policy=outbound [01:00:22.067675] x=ABC mod=mail cmd=attachment file=text.html size=3347 [01:00:22.039732] x=ABC mod=mail cmd=attachment file=text.txt size=2093 [01:00:22.010986] x=ABC mod=session cmd=data [email protected] [01:00:22.010986] x=ABC mod=session cmd=data [email protected] [01:00:22.000234] x=ABC mod=mail [email protected] Tabled to show how data is structured for columns I care about: ╔═══════════════════╦═════╦══════════╦═══════════╦════════════════════╦═════════════════╦══════╦═════════╗ ║ time ║ x ║ subject ║ file ║ sender ║ rcpt ║ size ║ rule ║ ╠═══════════════════╬═════╬══════════╬═══════════╬════════════════════╬═════════════════╬══════╬═════════╣ ║ [01:00:22.164297] ║ ABC ║ Test 123 ║ ║ ║ ║ 8583 ║ ruleQ ║ ║ [01:00:22.136496] ║ ABC ║ ║ ║ ║ ║ ║ notspam ║ ║ [01:00:22.106325] ║ ABC ║ ║ ║ ║ ║ ║ ║ ║ [01:00:22.067675] ║ ABC ║ ║ text.html ║ ║ ║ 3347 ║ ║ ║ [01:00:22.039732] ║ ABC ║ ║ text.txt ║ ║ ║ 2093 ║ ║ ║ [01:00:22.010986] ║ ABC ║ ║ ║ ║ [email protected] ║ ║ ║ ║ [01:00:22.010986] ║ ABC ║ ║ ║ ║ [email protected] ║ ║ ║ ║ [01:00:22.000234] ║ ABC ║ ║ ║ [email protected] ║ ║ ║ ║ ╚═══════════════════╩═════╩══════════╩═══════════╩════════════════════╩═════════════════╩══════╩═════════╝ This is what I'd like to get back: ╔═══════════════════╦═════╦══════════╦═══════════╦════════════════════╦═════════════════╦══════╦═════════╗ ║ time ║ x ║ subject ║ file ║ sender ║ rcpt ║ size ║ rule ║ ╠═══════════════════╬═════╬══════════╬═══════════╬════════════════════╬═════════════════╬══════╬═════════╣ ║ [01:00:22.164297] ║ ABC ║ Test 123 ║ text.html ║ [email protected] ║ [email protected] ║ 3347 ║ notspam ║ ║ [01:00:22.164297] ║ ABC ║ Test 123 ║ text.txt ║ [email protected] ║ [email protected] ║ 2093 ║ notspam ║ ║ [01:00:22.164297] ║ ABC ║ Test 123 ║ text.html ║ [email protected] ║ [email protected] ║ 3347 ║ notspam ║ ║ [01:00:22.164297] ║ ABC ║ Test 123 ║ text.txt ║ [email protected] ║ [email protected] ║ 2093 ║ notspam ║ ╚═══════════════════╩═════╩══════════╩═══════════╩════════════════════╩═════════════════╩══════╩═════════╝ As you can see, the transformations I want for the data include: creating a unique row for each person receiving each attachment the size value is for the attachment, while the size of the whole message is dropped The time from the entry which contains the subject name is used for each entry The 'rule' from mod=spam AND rule!=null fills in the rule column for each entry, and the rule from the line which contains subject is ignored The subject, sender and rule get copied to every entry ... View more

I have a query which returns a field which is occasionally a 13-digit hexadecimal value, and occasionally a string which may or may not be 13 characters long. I'd like to create an output of just the items which match hex. There is lots written on converting hex, but I want to leave it intact for the search. Thanks! ... View more

I have a log output which provides many fields, but the two I'm most concerned with are user and device. I'm trying to output a list of users and devices which corresponds with the user from the log data, only in the event that the user has more than one device associated: I.e.: JohnSmith DeviceA JohnSmith DeviceB SteveSmith DeviceB SteveSmith DeviceC TedSmith DeviceX TedSmith DeviceY TedSmith DeviceZ I don't care about users who have only one device assigned, and want to focus on users where the distinct count of devices >1. ... View more