Linux grep文件1中的内容在文件2中[重复]

Question

ranjit abraham

Asked: 2024-10-10 22:45:52 +0800 CST2024-10-10 22:45:52 +0800 CST 2024-10-10 22:45:52 +0800 CST

Sed 命令不匹配并替换多行 xml 上的模式

772

我有许多如下所示的 XML 文件，我想用新字符串替换其中的字符串。我似乎无法让 sed 命令在 xml 文件上工作。

<form version="1.1" theme="dark">
  <label>Forcepoint DLP Dashboard - LongTerm</label>
  <description>Activity for those with Long-Term Exceptions</description>
  <fieldset submitButton="false" autoRun="false">
    <input type="time" token="TimeFrame" searchWhenChanged="true">
      <label>Timeframe</label>
      <default>
        <earliest>-48h@h</earliest>
        <latest>now</latest>
      </default>
    </input>
  </fieldset>
  <row>
    <panel>
      <html>
        <p>Macros In Use:</p>
        <p>`ForcepointApprovedUSB` = Known Approved USB Devices</p>
        <p>`ForcepointKnownCDDVD` = Known CD/DVD Drives</p>
        <p>`ForcepointKnownMultiFunction` = Known Multi-Function Devices</p>
      </html>
    </panel>
  </row>
  <row>
    <panel>
      <title>Exception Info</title>
      <table>
        <search>
          <query>index=restricted_security 
sourcetype=forcepoint 
| rex field=_raw "(.*act=(?&lt;Action&gt;.*?)\s.*)"
| rex field=_raw "(.*duser=(?&lt;Device&gt;.*?)(:\s\d|;|\sfname=).*)"
| rex field=_raw "(.*duser=.*?;\s(?&lt;Serial&gt;.*?)\sfname=)"
| rex field=_raw "(.*fname=(?&lt;Filename&gt;.*?)\smsg=.*)"
| rex field=_raw "(.*fname=.:\\\(?&lt;RawFilename&gt;.*)(?:\s-\s.*)\smsg=.*)"
| rex field=_raw "(.*suser=(?&lt;Name&gt;.*)\scat=.*)"
| rex field=_raw "(.*loginName=.*\\\\(?&lt;Username&gt;.*)\ssourceIp=.*)"
| rex field=_raw "(.*sourceIp=(?&lt;IP&gt;.*)\sseverityType=.*)"
| rex field=_raw "(.*sourceHost=(?&lt;Source&gt;.*)\sproductVersion=.*)"
| rex field=_raw "(.*sourceServiceName=(?&lt;AlertType&gt;.*)\sanalyzedBy=.*)"
| eval Username=lower(Username)
| eval Action=if(isnull(Action),"-",Action)
| eval Serial=if(isnull(Serial),"-",Serial)
| eval EnumDeviceType=case(
    (`ForcepointApprovedUSB`),"ApprovedUSB",
    (`ForcepointKnownCDDVD`),"CDDVD",
    (`ForcepointKnownMultiFunction`),"MultiFunction",
    AlertType="Endpoint Applications" AND Device="Bluetooth","Bluetooth",
    AlertType="Endpoint Removable Media" AND Device="Windows Portable Device (WPD)","WPD",
    AlertType="Endpoint Removable Media" AND 
        Device!="Windows Portable Device (WPD)" AND NOT 
        (`ForcepointApprovedUSB`) AND NOT 
        (`ForcepointKnownCDDVD`) AND NOT 
        (`ForcepointKnownMultiFunction`),"UnApprovedUSB")
| join type=inner Username
[
    search
    index=restricted_security
    sourcetype=dlp_lt
    | rename UserID as Username
    | eval Check = "Yes"
    | fields Username,Check,Justification,Type,ExpireDate
]
| where isnotnull(EnumDeviceType) AND Check="Yes"
| eval Time=strftime(_time, "%B %d, %Y %H:%M %Z")
| dedup Username
| table Time Username Name Justification Type ExpireDate
| sort Name</query>
          <earliest>$TimeFrame.earliest$</earliest>
          <latest>$TimeFrame.latest$</latest>
        </search>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
  </row>
  <row>
    <panel>
      <title>Transfers By Those With Long-Term Exceptions</title>
      <table>
        <search>
          <query>index=restricted_security 
sourcetype=forcepoint 
| rex field=_raw "(.*act=(?&lt;Action&gt;.*?)\s.*)"
| rex field=_raw "(.*duser=(?&lt;Device&gt;.*?)(:\s\d|;|\sfname=).*)"
| rex field=_raw "(.*duser=.*?;\s(?&lt;Serial&gt;.*?)\sfname=)"
| rex field=_raw "(.*fname=(?&lt;Filename&gt;.*?)\smsg=.*)"
| rex field=_raw "(.*fname=.:\\\(?&lt;RawFilename&gt;.*)(?:\s-\s.*)\smsg=.*)"
| rex field=_raw "(.*suser=(?&lt;Name&gt;.*)\scat=.*)"
| rex field=_raw "(.*loginName=.*\\\\(?&lt;Username&gt;.*)\ssourceIp=.*)"
| rex field=_raw "(.*sourceIp=(?&lt;IP&gt;.*)\sseverityType=.*)"
| rex field=_raw "(.*sourceHost=(?&lt;Source&gt;.*)\sproductVersion=.*)"
| rex field=_raw "(.*sourceServiceName=(?&lt;AlertType&gt;.*)\sanalyzedBy=.*)"
| eval Username=lower(Username)
| eval Action=if(isnull(Action),"-",Action)
| eval Serial=if(isnull(Serial),"-",Serial)
| eval EnumDeviceType=case(
    (`ForcepointApprovedUSB`),"ApprovedUSB",
    (`ForcepointKnownCDDVD`),"CDDVD",
    (`ForcepointKnownMultiFunction`),"MultiFunction",
    AlertType="Endpoint Applications" AND Device="Bluetooth","Bluetooth",
    AlertType="Endpoint Removable Media" AND Device="Windows Portable Device (WPD)","WPD",
    AlertType="Endpoint Removable Media" AND 
        Device!="Windows Portable Device (WPD)" AND NOT 
        (`ForcepointApprovedUSB`) AND NOT 
        (`ForcepointKnownCDDVD`) AND NOT 
        (`ForcepointKnownMultiFunction`),"UnApprovedUSB")
| join type=inner Username
[
    search
    index=restricted_emn_security
    sourcetype=dlp_lt
    | rename UserID as Username
    | eval Check = "Yes"
    | dedup Username
    | fields Username, Check
]
| where isnotnull(EnumDeviceType) AND Check="Yes"
| eval Time=strftime(_time, "%B %d, %Y %H:%M %Z")
| table Time Username Name Action Source Filename Device Serial EnumDeviceType
| sort -Time</query>
          <earliest>$TimeFrame.earliest$</earliest>
          <latest>$TimeFrame.latest$</latest>
        </search>
        <option name="count">30</option>
        <option name="drilldown">none</option>
      </table>
    </panel>
  </row>
</form>

我想要替换的模式是

index=restricted_security sourcetype=forcepoint

和

index=newname
sourcetype=forcepoint

因此任何模式

index=restricted_security
sourcetype=forcepoint

应被新值替换。

XML 文件有很多组合，例如

index=restricted_security
sourcetype=someother value, index=someindex sourcetype=forcepoint

等等，但它们不需要被替换。

我已经尝试了像下面这样的许多模式和许多 sed 的组合，但似乎不起作用

sed 's/index=restricted_security\s\nsourcetype=forcepoint/index=restricted_security sourcetype=forcepoint/g'

有人能指出如何替换它吗？

3 个回答

Voted

Gilles Quénot · Answer 1 · 2024-10-10T23:27:55+08:00

Gilles Quénot

2024-10-10T23:27:55+08:002024-10-10T23:27:55+08:00

使用Python 的lxml：

import re
from lxml import etree

file_path = '/tmp/file.xml'

tree = etree.parse(file_path)
root = tree.getroot()

xpath_expression = '//table/search/query/text()'
text_nodes = root.xpath(xpath_expression)

if text_nodes:
    first_text_node = text_nodes[0]
    lines = first_text_node.splitlines()
    if lines and 'index=restricted_security' in lines[0]:
        lines[0] = 'index=NEW_NAME'
        updated_text = '\n'.join(lines)
        parent_element = first_text_node.getparent()
        parent_element.text = updated_text
        tree.write(file_path, pretty_print=True, xml_declaration=True, encoding='UTF-8')

该脚本就地编辑该文件。

6

Gilles Quénot · Answer 2 · 2024-10-11T00:14:38+08:00

Gilles Quénot

2024-10-11T00:14:38+08:002024-10-11T00:14:38+08:00

用作`xmlstarlet`shell 命令，在此实用程序的 2 次调用中：

#!/bin/sh
 
xmlstarlet sel -t -v '//table/search/query/text()' file.xml > /tmp/temp.txt
grep 'index=restricted_security' /tmp/temp.txt || exit 0
xmlstarlet ed -u '//table/search/query' -v "index=NEW_NAME
$(awk 'NR>1' /tmp/temp.txt)" file.xml

如果您需要就地编辑，则可以添加-L开关。xmlstarlet ed

如果需要，您甚至可以`/tmp/temp.txt`使用以下命令编辑文件`sed`：

（这不是XML第一次执行后的文本xmlstarlet）

#!/bin/sh
 
xmlstarlet sel -t -v '//table/search/query/text()' file.xml > /tmp/temp.txt
sed -i 's/index=restricted_security/index=NEW_NAME/' /tmp/temp.txt
xmlstarlet ed -u '//table/search/query' -v "$(</tmp/temp.txt)" file.xml

6

Ed Morton · Answer 3 · 2024-10-11T04:44:51+08:00

Best Answer

Ed Morton

2024-10-11T04:44:51+08:002024-10-11T04:44:51+08:00

使用 GNU sed 表示-z、、空格简写以及单词边界和-E：\s\<\>

$ sed -Ez 's/\<(index=)restricted_security(\s+sourcetype=forcepoint)\>/\1newname\2/g' file > o1

$ diff file o1
28c28
<           <query>index=restricted_security
---
>           <query>index=newname
81c81
<           <query>index=restricted_security
---
>           <query>index=newname

或者如果你想要将两个字符串连接成一行（从你的问题中看不清楚）：

$ sed -Ez 's/\<(index=)restricted_security\s+(sourcetype=forcepoint)\>/\1newname \2/g' file > o1

$ diff file o1
28,29c28
<           <query>index=restricted_security
< sourcetype=forcepoint
---
>           <query>index=newname sourcetype=forcepoint
81,82c80
<           <query>index=restricted_security
< sourcetype=forcepoint
---
>           <query>index=newname sourcetype=forcepoint

4

Sed 命令不匹配并替换多行 xml 上的模式

用作`xmlstarlet`shell 命令，在此实用程序的 2 次调用中：

如果需要，您甚至可以`/tmp/temp.txt`使用以下命令编辑文件`sed`：

模块 i915 可能缺少固件 /lib/firmware/i915/*

无法获取 jessie backports 存储库

如何将 GPG 私钥和公钥导出到文件

我们如何运行存储在变量中的命令？

如何配置 systemd-resolved 和 systemd-networkd 以使用本地 DNS 服务器来解析本地域和远程 DNS 服务器来解析远程域？

dist-upgrade 后 Kali Linux 中的 apt-get update 错误 [重复]

如何从 systemctl 服务日志中查看最新的 x 行

Nano - 跳转到文件末尾

grub 错误：你需要先加载内核

如何下载软件包而不是使用 apt-get 命令安装它？

Sed 命令不匹配并替换多行 xml 上的模式

3 个回答

用作xmlstarletshell 命令，在此实用程序的 2 次调用中：

如果需要，您甚至可以/tmp/temp.txt使用以下命令编辑文件sed：

相关问题

用作`xmlstarlet`shell 命令，在此实用程序的 2 次调用中：

如果需要，您甚至可以`/tmp/temp.txt`使用以下命令编辑文件`sed`：