美好的一天。PowerShell。團體對象使用
我有日誌文件,像這樣的臺詞:
192.168.0.28 - - [10/Feb/2014:16:24:33 +0400] "GET http://yabs.yandex.ru/count/SkPKYklqq7a40000ZhP7Z2y5KfK1cm9kGxS193E8jW1RNmQ9frz84PXWdPSZ3QPeYg8taCczkTWB0m6g8wMlFhK2lA6enWAD0P6uxymm1e-pXw430f-Z_uc4auKDcGL2Z90-IQ2WMc82hv0-IPIJQIgdaouLgBOaDFy5fB00000DhlaDKclHOmpo1B41ieGGkPSZ3RlXnNxwbZbWAtaI HTTP/1.1" 302 868 TCP_MISS:DIRECT
192.168.0.69 - - [10/Feb/2014:16:24:34 +0400] "GET http://cdn.v.rtr-vesti.ru/_cdn_auth/secure/v/vh/vod_hls/definst/smil:vh/smil/967/362_d20140204202900.smil/media-b1296000_25.ts? HTTP/1.1" 200 1552555 TCP_MISS:DIRECT
192.168.0.31 - - [10/Feb/2014:16:24:34 +0400] "GET http://57.img.avito.st/140x105/446703657.jpg HTTP/1.1" 200 3674 TCP_MISS:DIRECT
192.168.0.31 - - [10/Feb/2014:16:24:34 +0400] "GET http://52.img.avito.st/140x105/628845352.jpg HTTP/1.1" 200 2836 TCP_MISS:DIRECT
192.168.0.29 - - [10/Feb/2014:16:24:35 +0400] "GET http://kad.arbitr.ru/Content/Static/Css/Common/cssie8.css HTTP/1.1" 404 2436 TCP_NEGATIVE_HIT:NONE
192.168.0.28 - - [10/Feb/2014:16:24:35 +0400] "GET http://www.google.com/jsapi HTTP/1.1" 200 6534 TCP_MISS:DIRECT
我用下面的Poweshell代碼從該日誌文件中提取信息:
$events_list = @()
Foreach ($line in gc 'D:\Downloads\test.txt') {
$substrings = [regex]::split($line,' ')
$cropped_url = [regex]::split($substrings[6],'/')
if ($cropped_url.Count -gt 4) {continue}
$domain = $cropped_url[0] + "//" + $cropped_url[2]
$date = $substrings[3] -replace "\[", ""
$objLine = New-Object System.Object
$objLine | Add-Member -type NoteProperty -name IP -value $substrings[0]
$objLine | Add-Member -type NoteProperty -name Date -value $date
$objLine | Add-Member -type NoteProperty -name Domain -value $domain
$events_list += $objLine
}
$events_list | Group-Object -Property Domain | Sort-Object -Property Count -Descending | ft Count, Name -AutoSize >> D:\Downloads\domains.txt
我只是拆分字符串,並創建一個對象具有有趣的屬性。
但我想收集關於分組後的字節的信息。我可以從日誌文件中此cmdlet添加另一個屬性,並獲得其值:
$objLine | Add-Member -type NoteProperty -name Bytes -value $substrings[9]
但如何總結這個字節從這個腳本產生的財產在分組對象獲取的總字節大小,從精確下載域?
哦,我想在分組後得到平等域名。 – user3297169