Skip to content

Instantly share code, notes, and snippets.

@dcode

dcode/bro2rt.awk

Last active August 29, 2015 14:17
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save dcode/da880045c0a73a616954 to your computer and use it in GitHub Desktop.
Save dcode/da880045c0a73a616954 to your computer and use it in GitHub Desktop.
Download ZIP
bro2rt.awk
Raw
bro2rt.awk
$1 ~ /#fields.*/ { print $0 "\tend"; next };
$1 ~ /#types/ { print $0 "\ttime"; next };
$1 ~ /^#.*/ { print $0; next};
$1 ~ /^[^#]/ { OFMT="%.16g"; print $0, $1+$9 }
Raw
gistfile1.sh-session
cat conn.log | awk -vOFS='\t' -f bro2rt.awk | /opt/bro/bin/bro-cut -uc | \
sed 's/#fields //' | grep -v "^#" | tr '\t' ',' | \
sed 's/\([0-9]\{4\}-[0-9]\{2\}-[0-9]\{2\}\)T\([^-]*\)-[0-9]\{4\}/\1 \2/g' > conn.csv
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment