linux - ubuntu awk 如何获取最后一个用户和时间数据？

Question

我的 last数据信息如:

test@test:~$ last
test     pts/0        172.25.48.1      Mon Sep 14 08:38   still logged in
test     pts/2        172.25.48.1      Mon Sep 14 03:32   still logged in
test     pts/1        172.25.48.1      Mon Sep 14 03:31   still logged in
test     pts/1        172.25.48.1      Mon Sep 14 03:22 - 03:31  (00:08)
test     pts/0        172.25.48.1      Mon Sep 14 03:00 - 03:39  (00:39)
test     pts/0        172.25.48.1      Mon Sep 14 02:11 - 02:50  (00:38)
test     pts/0        172.20.80.1      Sun Sep 13 11:34 - 17:02  (05:27)
test     pts/0        172.20.80.1      Sun Sep 13 11:33 - 11:33  (00:00)
test     tty1                          Sun Sep 13 10:53    gone - no logout
reboot   system boot  5.4.0-47-generic Sun Sep 13 10:53   still running
test     pts/1        172.20.80.1      Wed Sep  9 08:39 - 11:52 (2+03:12)
test     pts/0        172.20.80.1      Wed Sep  9 07:04 - 08:45  (01:40)
reboot   system boot  5.4.0-47-generic Wed Sep  9 03:06   still running
reboot   system boot  5.4.0-47-generic Wed Sep  9 03:04   still running
test     tty1                          Wed Sep  9 03:03 - crash  (00:00)
reboot   system boot  5.4.0-47-generic Wed Sep  9 03:03   still running
test     pts/0        172.20.80.1      Wed Sep  9 03:02 - crash  (00:01)
test     tty1                          Wed Sep  9 02:51 - crash  (00:12)
reboot   system boot  5.4.0-47-generic Wed Sep  9 02:50   still running

预期:我想获得以下信息:

test     Mon Sep 14 08:38
test     Mon Sep 14 03:32
test     Mon Sep 14 03:31
test     Mon Sep 14 03:22
test     Mon Sep 14 03:00
test     Mon Sep 14 02:11
test     Sun Sep 13 11:34
test     Sun Sep 13 11:33
test     Sun Sep 13 10:53
reboot   Sun Sep 13 10:53
test     Wed Sep  9 08:39
test     Wed Sep  9 07:04
reboot   Wed Sep  9 03:06
reboot   Wed Sep  9 03:04
test     Wed Sep  9 03:03
reboot   Wed Sep  9 03:03
test     Wed Sep  9 03:02
test     Wed Sep  9 02:51
reboot   Wed Sep  9 02:50

实际上:但我试图命令 last | awk '{print $1"\t"$4}' ，系统返回数据如:

test@test:~$ last | awk '{print $1"\t"$4}'
test    Mon
test    Mon
test    Mon
test    Mon
test    Mon
test    Mon
test    Sun
test    Sun
test    Sep
reboot  5.4.0-47-generic
test    Wed
test    Wed
reboot  5.4.0-47-generic
reboot  5.4.0-47-generic
test    Sep
reboot  5.4.0-47-generic
test    Wed
test    Sep
reboot  5.4.0-47-generic
    
wtmp    Sep

更新
我试过 last --time-format iso | awk '{print $1"\t"$4}'但有些数据不对。

test@test:~$ last --time-format iso | awk '{print $1"\t"$4}'
test    2020-09-14T08:38:15+00:00
test    2020-09-14T03:32:02+00:00
test    2020-09-14T03:31:33+00:00
test    2020-09-14T03:22:37+00:00
test    2020-09-14T03:00:05+00:00
test    2020-09-14T02:11:39+00:00
test    2020-09-13T11:34:43+00:00
test    2020-09-13T11:33:36+00:00
test    gone
reboot  5.4.0-47-generic
test    2020-09-09T08:39:02+00:00
test    2020-09-09T07:04:41+00:00
reboot  5.4.0-47-generic
reboot  5.4.0-47-generic
test    -
reboot  5.4.0-47-generic
test    2020-09-09T03:02:08+00:00
test    -
reboot  5.4.0-47-generic

Answer 1

如果您的输出是示例中显示的固定宽度字段，并且您有 GNU awk，那么:

$ cat file | awk -v FIELDWIDTHS='9 30 16' '{print $1 $3}'
test     Mon Sep 14 08:38
test     Mon Sep 14 03:32
test     Mon Sep 14 03:31
test     Mon Sep 14 03:22
test     Mon Sep 14 03:00
test     Mon Sep 14 02:11
test     Sun Sep 13 11:34
test     Sun Sep 13 11:33
test     Sun Sep 13 10:53
reboot   Sun Sep 13 10:53
test     Wed Sep  9 08:39
test     Wed Sep  9 07:04
reboot   Wed Sep  9 03:06
reboot   Wed Sep  9 03:04
test     Wed Sep  9 03:03
reboot   Wed Sep  9 03:03
test     Wed Sep  9 03:02
test     Wed Sep  9 02:51
reboot   Wed Sep  9 02:50

在上面我使用 cat file代替 last我没有。