Get the last word on each line

Question

I have a large text file generated from strace which contains in brief :

% time     seconds  usecs/call     calls    errors syscall
------ ----------- ----------- --------- --------- ----------------
 42.93    3.095527         247     12512           unshare
 19.64    1.416000        2975       476           access
 13.65    0.984000        3046       323           lstat
 12.09    0.871552         389      2239       330 futex
 11.47    0.827229          77     10680           epoll_wait
  0.08    0.005779          66        88           fadvise64
  0.06    0.004253           4      1043       193 read
  0.06    0.004000           3      1529         3 lstat
  0.00    0.000344           0      2254      1761 stat
[...]
  0.00    0.000000           0         1           fallocate
  0.00    0.000000           0        24           access
  0.00    0.000000           0         1           open

Excluding the first header line, I would like to get from each line the last field, corresponding to the syscall column. Those would include:

• unshare
• access
• lstat
• futex
• epoll_wait
• .
• ..
• ...

This is what I tried tail -n -13 seccomp | awk '{print $5}', which has been able to ignore the first line but somehow some lines containing the error row are ignored due to my search been not refined.

How do i implement this?

Answer 1

Or like so:

awk 'NR>2 {print $NF}' seccomp
unshare
access
.
.
.

which, for lines beyond the second, prints the last field of the line. NF holds the number of fields, $NF "expands" to the last field's contents¹.

---

^{¹ or the whole record if it doesn't contain any field (is made of blanks only with the default value of FS, the field separator).}

Answer 2

You can easily use grep with option -o (short form of --only-matching).

grep -o "\w*$" filename

• \w matches any word character (alphanumeric and underscore)
• \w* matches multiple (including zero) word characters
• \w*$ matches multiple word characters at the end of the line

To skip the header, use tail -n +3 as suggested by others:

tail -n +3 filename | grep -o "\w*$"

The output is like this:

unshare
access
lstat
futex
epoll_wait
fadvise64
read
lstat
stat
fallocate
access
open

Answer 3

With sed it would be simply

sed '1,2d;s/.* //'

• 1,2d mean to delete the first to second line, replacing the tail
• the substitute command removes everything up to the last whitespace, so you don't need to count columns

To my knowledge, syscalls can't contain any whitespace, so this should work. Otherwise you could rely on the name starting at the 61st character, removing the first 60:

sed '1,2d;s/.\{60\}//'

Answer 4

The standard idiom for printing the last field on a line is

awk '{print $NF}'

The NF variable is automatically set to the Number of Fields on the line, and then $ extracts that field.

I'd say the easiest and safest way to get rid of the unwanted header lines is with egrep.

Putting this all together we have:

scs$ awk '{print $NF}' seccomp | egrep -v '^(--*|syscall)$'

(This would wrongly exclude an actual syscall named "syscall". Presumably that shouldn't be a problem.)

Answer 5

Using GNU grep and tail with perl-style regex

grep -Po '.* \K.*' file | tail -12
unshare
access
lstat
futex
epoll_wait
fadvise64
read
lstat
stat
fallocate
access
open

grep -o '[^] ]*$' file | tail -12
unshare
access
lstat
futex
epoll_wait
fadvise64
read
lstat
stat
fallocate
access
open

Answer 6

If all the important lines begin with a digit, then

awk '$1~/^[0-9]/{print $NF}'

Answer 7

Using Raku (formerly known as Perl_6)

raku -ne '.words[*-1].put;' 

OR

raku -ne '.words.tail.put;' 

Command line flags -ne are used to run the code linewise (non-autoprinting) over the file. The .words call breaks on whitespace: it's short for $_.words wherein $_ denotes the 'topic' variable. Indexing is accomplished via [*-1] 'whatever-star'-minus-one to get the last word, or more simply with .tail. Printing is accomplished using .put ('print-using-terminator', aka \n).

Sample Input:

 42.93    3.095527         247     12512           unshare
 19.64    1.416000        2975       476           access
 13.65    0.984000        3046       323           lstat
 12.09    0.871552         389      2239       330 futex
 11.47    0.827229          77     10680           epoll_wait
  0.08    0.005779          66        88           fadvise64
  0.06    0.004253           4      1043       193 read
  0.06    0.004000           3      1529         3 lstat
  0.00    0.000344           0      2254      1761 stat
  0.00    0.000000           0         1           fallocate
  0.00    0.000000           0        24           access
  0.00    0.000000           0         1           open

Sample Output:

unshare
access
lstat
futex
epoll_wait
fadvise64
read
lstat
stat
fallocate
access
open

Note: if having the header line show up in your output is problematic, you can skip outputting the initial 2 lines with the following code: below ++$ acts as an anonymous state variable that only initializes once, and then increments to count the lines as they're processed:

raku -ne '.words.tail.put if ++$ > 2;' 

https://docs.raku.org/syntax/state
https://raku.org

Answer 8

GNU dc , an RPN desk calculator , can pop space separated arguments from its stack. For string data, as is the last field, we enclose it within square brackets first using sed stream editor.

< file \
sed -En '1,2!s/\S+$/[&]/p' |
dc -e "[q]sq [?z0=qpcz0=?]s?
0_0=?"

---

POSIXly sed can take care of popping the last field. We replace all spaces by newlines and then keep deleting the leading elements . This process terminates wHen no space remains => we are at the last field. Assuming no trailing spaces.

sed '1,2d
  y/ /\n/
  /\n/D' file

---

perl can do it by using the ternary operator ?

perl -pe '($_) = $.>2 ? /\S+\n/g : ()' file