Awk script to extract the Multiple different delimiter lines

Question

Log file:

25 Apr 2022 02:55:08,062  ; 12345678908,123456789, added soc:[DSPSIA2D9,450, USGPRSPPF,0] deleted soc:[] ldap soc:[DSPSIA2D9,450, OPTSRA1H7,52, USGPRSPPF,0] db SOC:[OPTSRA1H7,52]

25 Apr 2022 02:55:08,872  ; 98765432101,234567833, added soc:[DSPSIA2EB,450, USGPRSPPF,0] deleted soc:[DSPSIA2CZ,450] ldap soc:[BBSUSPEND,0, DSPSIA2EB,450, OPTSRA1H7,52, USGPRSPPF,0, BBSUSPEND,0, USGPRSPPF,0] db SOC:[BBSUSPEND,0, BBSUSPEND,0, DSPSIA2CZ,450, OPTSRA1H7,52, USGPRSPPF,0]

25 Apr 2022 02:55:09,413  ; 23456789022,123456789, added soc:[DSPSIA2D6,450] deleted soc:[DSPSIA0R6,450] ldap soc:[BBSUSPEND,0, DSPSIA2D6,450, OPTSRA1H7,52, USGPRSPPF,0, BBSUSPEND,0] db SOC:[BBSUSPEND,0, BBSUSPEND,0, DSPSIA0R6,450, OPTSRA1H7,52, USGPRSPPF,0]

If the "added soc" contains "USGPRSPPF" and extract the sixth column values.

Output:

12345678908
98765432101

Answer 1

I would use GNU AWK for this task following way, let file.txt content be

25 Apr 2022 02:55:08,062 ; 12345678908,123456789, added soc:[DSPSIA2D9,450, USGPRSPPF,0] deleted soc:[] ldap soc:[DSPSIA2D9,450, OPTSRA1H7,52, USGPRSPPF,0] db SOC:[OPTSRA1H7,52]

25 Apr 2022 02:55:08,872 ; 98765432101,234567833, added soc:[DSPSIA2EB,450, USGPRSPPF,0] deleted soc:[DSPSIA2CZ,450] ldap soc:[BBSUSPEND,0, DSPSIA2EB,450, OPTSRA1H7,52, USGPRSPPF,0, BBSUSPEND,0, USGPRSPPF,0] db SOC:[BBSUSPEND,0, BBSUSPEND,0, DSPSIA2CZ,450, OPTSRA1H7,52, USGPRSPPF,0]

25 Apr 2022 02:55:09,413 ; 23456789022,123456789, added soc:[DSPSIA2D6,450] deleted soc:[DSPSIA0R6,450] ldap soc:[BBSUSPEND,0, DSPSIA2D6,450, OPTSRA1H7,52, USGPRSPPF,0, BBSUSPEND,0] db SOC:[BBSUSPEND,0, BBSUSPEND,0, DSPSIA0R6,450, OPTSRA1H7,52, USGPRSPPF,0]

then

awk 'BEGIN{FS="[[:space:]]+|,"}/added soc:\[[^\]]*USGPRSPPF/{print $7}' file.txt

gives output

12345678908
98765432101

Explanation: I inform GNU AWK that field separator (FS) is one or more (+) whitespace characters or (|) ,. Then for every line which contain added soc:[ followed by zero or more not-] followed by USGPRSPPF I print 7th field. Note that literal [ and ] needs to be escaped as they have special meaning inside regular expression.

(tested in gawk 4.2.1)