Re: help for extract "extension" from filename and print it with filename

[Z]

lacsaP Patatetom <patatetom@gmail.com> wrote:

> hi,
> 
> I would like to extract the "extension" of the filename and print these two
> pieces of information.
> I use `gawk` very occasionally and have done a few searches on the internet
> without success.
> 
> I use `ntfsundelete` like this :
> ```
> $ ntfsundelete -f -p 100 -t 1m -S 1k-4m /dev/nvme0n1p2 | head
> Inode    Flags  %age     Date    Time       Size  Filename
> -----------------------------------------------------------------------
> 1772     FN..   100%  2024-03-12 18:45     32768  EventStore.db-shm
> 2705     FN..   100%  2024-03-12 18:45     32768  EventStore.db-shm
> 2755     FN..   100%  2024-03-12 19:48     32992  EventStore.db-wal
> 2757     FN..   100%  2024-03-12 18:45     32768  EventStore.db-shm
> 2774     FN..   100%  2024-03-12 18:45      3936
>  2031232367709955654_trigger.dat
> 2904     FN..   100%  2024-03-12 19:46      1236
>  6258807092785928627_data.dat
> 6603     FN..   100%  2024-03-12 18:45      1864
>  2031232367709955654_data.dat
> 6659     FN..   100%  2024-03-12 19:49   2925232  mpenginedb.db-wal
> ```
> 
> and I would like to print something like this :
> ```
> db-shm EventStore.db-shm
> db-shm EventStore.db-shm
> db-wal EventStore.db-wal
> db-shm EventStore.db-shm
> dat 2031232367709955654_trigger.dat
> dat 6258807092785928627_data.dat
> dat 2031232367709955654_data.dat
> db-wal mpenginedb.db-wal
> ```
> 
> so I try this with `gawk` but
> 1) filename is not printed
> and
> 2) I have an error :
> ```
> ntfsundelete -f -p 100 -t 1m -S 1k-4m /dev/nvme0n1p2 | head | sed 1,2d |
> awk '{ext=$7;sub("^.*\\.","",$ext);print $ext, $7}'
> db-shm
> db-shm
> db-wal
> db-shm
> awk: cmd. line:1: (FILENAME=- FNR=5) fatal: field.c:134:grow_fields_arr:
> fields_arr: cannot reallocate -2196885132029906936 bytes of memory: Cannot
> allocate memory
> ```
> 
> apart from me ;-), what's the problem ?
> 
> regards, lacsaP.

Hi,
Although you got something working you might want to make the matching less
rigidly tied to specific field numbers.  Also it's probably better to avoid
sub()/gsub() unless necessary.  This seems to produce the results you're
after without the sed(1) pre-filter:

$ cat data |nawk 'NR>2{N=index($NF,".");print substr($NF,N+1),"\t",$NF}'
db-shm   EventStore.db-shm
db-shm   EventStore.db-shm
db-wal   EventStore.db-wal
db-shm   EventStore.db-shm
dat      2031232367709955654_trigger.dat
dat      6258807092785928627_data.dat
dat      2031232367709955654_data.dat
db-wal   mpenginedb.db-wal

(useless cat for stream mimic ; "\t" improves readability)

Cheers,
Z