awk, from last column to \r\n (CRNL) - linux

Question

I have a file with lines like so:
Internet Protocol Version 4, Src: 192.168.0.29 (192.168.0.29), Dst: www.l.google.com (64.233.187.104)
Time to live: 128
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.5) Gecko/20041107 Firefox/1.0\r\n
if I use $NF I end up with:
rv:1.7.5)
but I want:
Firefox/1.0
I want to make my script, below, do that:
awk '
/ User-Agent/{brow=$NF}
END{
print brow;
}
'
any suggestions would be appreciated!
Full script: (fixed)
#!/bin/bash
echo $1;
awk '/ User-Agent/{print}' $1 > useragents_$1;
echo '----------------------------------------------------' >> useragents_$1;
sort useragents_$1 | uniq >> useragents_$1;
awk '
/Internet Protocol Version 4, Src:/{ip=$(NF-4)}
/ Time to live/{ttl++}
/ Time to live/{sttl=$NF}
/ User-Agent/{os=$(NF-6)" "$(NF-5)}
/ User-Agent/{brow=$NF}
/ User-Agent/{agent++}
/ User-Agent/{stringtemp=sttl"\t"ip"\t"os"\t"brow}
/Windows/{windows++}
/Linux/{linux++}
/Solaris/{solaris++}
END{
sub(/\\r.*$/, "", brow);
print "TTL\tIP\t\tOS\t\tBROWSER";
print stringtemp;
print "\nSUMMARY";
print "\tttl\t=\t"ttl; print "\twindows\t=\t"windows;
print "\tlinux\t=\t"linux; print "\tsolaris\t=\t"solaris;
print "\tagent\t=\t"agent
}
' $1 > useragents_$1;
more useragents_$1;
Output:
examplehttppacket.txt
TTL IP OS BROWSER
128 192.168.0.29 Windows NT Firefox/1.0\r\n
SUMMARY
ttl = 1
windows = 3
linux =
solaris =
agent = 1
Thanks for all your help everybody, looks like it was mostly a text file problem!

Answer 1

This awk should work:
awk '/User-Agent/{brow=$NF} END{sub(/\\r.*$/, "", brow); print brow;}' file

Answer 2

If I assume that your sample script has a typo (i.e., that you mean /User-Agent/, with no leading spaces), then given this input file:
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.5) Gecko/20041107 Firefox/1.0
And this script:
awk '
/User-Agent/{brow=$NF}
END{
print brow;
}
'
Then I get this output:
Firefox/1.0
Which seems to be exactly what you want. If you're seeing different behavior, please update your question with information about your operating system and an example of actual input and actual output that demonstrates the problem.

Answer 3

awk '/User-Agent/{brow=$NF}; END{print brow;}' file_name
Works fine.

Answer 4

I guess the first thing to try is to remove the \r chars
awk '
{gsub(/^M/, "", $0)}
/ User-Agent/{brow=$NF}
END{
print brow;
} file
If using the VI(M) editor, enter the Ctrl-M (^M above) as one char, and using vi(m)s escape char feature, by pressing Ctrl-V (and then) Ctrl-M.
IHTH