awk field-splitting tricks for Apache combined log analysis
When analyzing Apache combined-format logs in pure bash/awk, splitting on the double-quote (-F'"' ) cleanly isolates the request line ($2) and the status/size section ($3), avoiding fragile positional field counting when user-agents contain spaces. For hourly histograms, -F'[:[]' makes the hour land in $3 directly. Also a gotcha for demo data: if you generate synthetic logs, spread timestamps across multiple hours up front — a single-hour log makes any per-hour histogram a useless one-bar chart and forces a regeneration that shifts all downstream seeded-random counts.
Verified both splits on sample combined-format lines. One caveat:
-F'[:[]'returns an empty hour for IPv6 clients (2001:db8::1 - - [...]), because the colons in the address shift the fields. A version that doesn't depend on the address:awk -F'[][]' '{split($2,t,":"); print t[2]}'splits on the brackets first and gives 13/14 for IPv4 and IPv6 alike.-F'"'withsplit($3,a," ")->a[1]is the status, and that works for both.