Print grep output into rows

Question

I'm new to Linux and putting some scripting skills to the test with a small loop that uses grep to parse email fields from whois record look-ups. It searches for fields that often contain registrant email addresses, then strips everything preceding the '@', leaving only the registrant domain. (Not much fun, in general, because whois records are notoriously inconsistent across regions)

I would like my final output to print the IP and its subsequent email addresses on the same row.

Here's my script in its current form:

while read ip
do
        echo "$ip"
        whois $ip | grep -i orgtechemail | cut -d@ -f 2 | cut -d"'" -f 1 | uniq
        whois $ip | grep -i orgabuseemail | cut -d@ -f 2 | cut -d"'" -f 1 | uniq
        whois $ip | grep -i e-mail | cut -d@ -f 2 | cut -d"'" -f 1 | uniq
        whois $ip | grep -i notify | cut -d@ -f 2 | cut -d"'" -f 1 | uniq
        whois $ip | grep -i abuse-mailbox | cut -d@ -f 2 | cut -d"'" -f 1 | uniq
        whois $ip | grep -i 'abuse contact' | cut -f 9- -d' ' | uniq
done < $1

My current output looks something like this:

204.154.186.2
bcbsks.com
bcbsks.com
72.165.233.67
centurylink.com
centurylinkservices.net

But I would prefer that with each email address that is found, it prints to the same line as the IP address. Like this:

204.154.186.2 bcbsks.com bcbsks.com
72.165.233.67 centurylink.com centurylinkservices.net

I found a short awk command that gets me part of the way there, but does not fully achieve what I'm looking for:

awk '{ORS=NR % 2? " ": "\n"; print}'

Thank you!

So `echo $(whois ....) $(whois....) $(whois....)`? You could pipe it to `awk '{printf "%s%s", $0, NR % 2? " ": "\n"}`. Or you could also `| tr -d '\n'` remove newlines from chosen outputs. — KamilCuk, Apr 08 '20 at 15:03
You will have far less problems if you query using RDAP instead of whois. Specifically for RIRs, it is completely standardized and available. Since the result is JSON, no need for complex regex. — Patrick Mevzek, Jun 04 '20 at 03:51

score 0 · Answer 1 · answered Apr 09 '20 at 00:20

Welcome to stackoverflow.

First command within the loop:

     echo -n "$ip"

That gets rid of the first new line (between the IP and first found domain)

For each of which whois line:

(example)

DOMAIN=`whois $ip | grep -i orgtechemail | cut -d@ -f 2 | cut -d"'" -f 1 | uniq`
echo -n $DOMAIN; echo -n " "

The second echo adds space between found domain without adding a new line.

Hope this helps.

Print grep output into rows

1 Answers1