In indeni.hawk, a series of functions are defined. They are simply helper functions that can be used in .ind scripts.


String manipulation functions
Array manipulation functions


Date manipulation functions


Table parsing functions

Let's say you have an input table that looks like this:


  PID USERNAME  THR PRI NICE   SIZE    RES STATE  C   TIME   WCPU COMMAND
 1449 root        4  76    0   214M 45968K select 0 269:40 99.17% flowd_octeon
 1471 root        1  76    0 12460K  5004K select 0   1:04  0.00% license-check
 1438 root        1  76    0 28088K  9720K select 0   0:38  7.10% mib2d
 1440 root        1  76    0 20300K  7808K select 0   0:36  0.00% l2ald

How do you parse this easily? With this code:

/(PID|USERNAME|COMMAND)/ {
    # Parse the line into a column array. The second parameter is the separator between column names.
    # The last parameter is the array to save the data into.
	getColumns(trim($0), "[ \t]+", columns)
}


/root.*%/ {
    # Use getColData to parse out the data for the specific column from the current line. The current line will be 
    # split according to the same separator we've passed in the getColumns function (it's stored in the "columns" variable).
    # If the column cannot be found, the result of getColData is null (not "null").
	cpu = getColData(trim($0), columns, "WCPU")
	memory = getColData(trim($0), columns, "RES")
	pid = getColData(trim($0), columns, "PID")
	processname = getColData(trim($0), columns, "COMMAND")


	if (getColData(trim($0), columns, "FOOBAR") == null) {
		# Handle column not found in original list of columns
	}
}


Collector output functions

      See Metrics for more information about the metric types. This will help you when choosing type for new metrics.
 

Flow related statements

Statements that can be used to control the execution flow of your script.

NF != 3 {
 	#This line doesn't have 3 fields. There is no reason to process it. Ignore and start-over with the next line.
 	next
}

# .. your code continues here.
# Only the lines with more than 3 fields will reach that point.



The getline statement is very similar to the "next" statement. The difference is that "getline" will read the next record immediately but it will not alter the flow of control in any way.
Meaning that the rest of the current actions executes with the new input record. (The "next" statement will start the process from the beginning)
Assuming that you have the following input:

My Data
-------------
my-username
my-password
a useless line..
my-email@email.com

and you script have to print only the username and the password lines.
So the logic is to read the 'username' after the line '--------------' and then continue the process.
For example:

/^---------/ {
	getline
	user = $0
	getline
	pass = $0
	getline
	getline
	email = $0
}

END {
	writeDebug("user is " user)
	writeDebug("pass is " pass)
	writeDebug("email is " email)
}

Note that the The getline command returns 1 if it finds a record and 0 if it encounters the end of the file. If there is some error in getting a record, such as a file that cannot be opened, then getline returns -1.


The break statement jumps out of the innermost for, while, or do loop that encloses it. Some times you don't want to continue the processing in

Multi-Step functions