Question

My sed only works if the input file last entry is ‘in’, how would I get it to work if file has ‘in’ or ‘out’? I’ve tried different variations with no success.

egrep -w 'TCP|UDP' denied.txt | sed 's/:[^:]* in/ in/'
egrep -w 'TCP|UDP' denied.txt | sed 's/:[^:]* in/ in/ out/ out/'
egrep -w 'TCP|UDP' denied.txt | sed 's/:[^:]* in/ in/ || out/ out/'

input file

Apr 6 08:54:23 TCP 212.58.244.58:80 in

Apr 6 09:29:09 TCP 212.58.244.58:443 out

Answer 1

Try with:

egrep -w 'TCP|UDP' denied.txt | sed 's/:[^:]* \(in\|out\)/ \1/'

See sed regular expressions.