Use grep -A1 to return a value in the second line as long as a numeric value in the first line is met

I have log entries that are paired two lines each. I have to parse the first line to extract a number to know if it is greater than 5000. If this number is greater than 5000 then I need to return the second line, which will also be parsed to retrieve an ID.

I know how to grep all of the info and to parse it. I don't know how to make the grep ignore things if they are less than a particular value. Note that I am not committed to using grep if some other means like awk/sed can be substituted.

Raw Data (two lines separated for example clarity).

The target of my grep is the number 5001 following "credits extracted = ", if this is over 5000 then I want to return number "12345" from the second line --------------------------

2012-03-16T23:26:12.082358 0x214d000 DEBUG ClientExtractAttachmentsPlayerMailTask for envelope 22334455 finished: credits extracted = 5001, items extracted count = 0, status = 0. [Mail.heomega.mail.Mail](PlayerMailTasks.cpp:OnExtractAttachmentsResponse:944)    
2012-03-16T23:26:12.082384 0x214d000 DEBUG Mail Cache found cached mailbox for: 12345 [Mail.heomega.mail.Mail](MailCache.cpp:GetCachedMailbox:772)

Snippits --------------------------

-- Find the number of credits extracted, without the comma noise:

grep "credits extracted = " fileName.log | awk '{print $12}' | awk -F',' '{print $1}'

-- Find the second line's ID no matter what the value of credits extracted is:

grep -A1 "credits extracted = " fileName.log | grep "cached mailbox for" | awk -F, '{print $1}' | awk '{print $10}'

-- An 'if' statement symbolizing the logic I need to acquire:

v_CredExtr=5001; v_ID=12345; if [ $v_Cred -gt 5000 ]; then echo $v_ID; fi;

2012-04-04 22:01
by James Pierce

note that S.O. posts use 4 spaces at the front of the line to indicate 'code sample'. I've reformatted your posting to highlight what your original text focused on. I usually only add code blocks and fix paragraph breaks. I have taken out a few '--' (while leaving others in), to make a more legible document. If you disagree, you can undo the edit, or reedit your post using the edit tool bar that appears at the top of the input box. Basically you mouse-hi-lite the text you want to format, and click on the tool to get the effect that you want. i.e. '{}' for code. good luck - shellter 2012-04-04 22:15

now consider editing your post to include your required output format, using the sample data you have included. This is most likely a one-liner in awk, but we'll be playing 20 questions until we see the required output. Good luck - shellter 2012-04-04 22:17

had to edit the above comment, refresh for most recent version ;-) Sorry - shellter 2012-04-04 22:19

You can do everything with a single AWK filter I believe:

#!/usr/bin/awk -f

/credits extracted =/ {
    credits = substr($12, 1, length($12) - 1) + 0
    if (credits > 5000)
        show_id = 1
    next
}

show_id == 1 {
    print $10
    show_id = 0
}

Obviously, you can stuff all the AWK script in a shell string inside a script, even multiline. I showed it here in its own script for clarity.

P.S: Please notify when it works ;-)

2012-04-04 22:25
by C2H5OH

You are so AWESOME!! I've been kicking this thing around for days and it took you minutes?! Baffling. Thank you - James Pierce 2012-04-04 23:40

You should definetely read the AWK bible and you'll be amazed about how useful AWK can be on text processing - C2H5OH 2012-04-04 23:49

Thanks for the recommendation. I just added it to my Amazon shopping cart and grabbed a manual from the GNU site. You've created a monster - James Pierce 2012-04-05 00:22