How do I print the highest/longest values in a file - bash

Question

I have an AV log file showing a number of values for each process scanned: Name, Path, Total files scanned, Scan time. The file contains hundreds of these process entries (example below) and for Total files scanned and Scan time I'd like to sort and print the highest (or longest) values so I can determine which processes are impacting the system. I've tried various ways with grep but only seem to get a list running in numerical order, when what I really want is to say Process id: 86, Scan time (ns): 12761174 is the highest, then Process id 25, etc. Hope my explanation is clear enough.
Process id: 25
Name: wwww
Path: "/usr/libexec/wwww"
Total files scanned: 42
Scan time (ns): "62416"
Status: Active
Process id: 7
Name: xxxx
Path: "/usr/libexec/xxxx"
Total files scanned: 0
Scan time (ns): "0"
Status: Active
Process id: 86
Name: yyyy
Path: "/usr/libexec/yyyy"
Total files scanned: 2
Scan time (ns): "12761174"
Status: Active
I have tried:
grep -Eo | grep 'Scan time (ns)' '[0-9]+' file | sort
Which results in:
file:Scan time (ns): "9391986"
file:Scan time (ns): "9532119"
file:Scan time (ns): "9730650"
file:Scan time (ns): "9743828"
file:Scan time (ns): "9793469"
file:Scan time (ns): "9911768"
What I am wanting to achieve is something such as:
Process id 9, Scan time (ns): "34561"
Process id 86, Scan time (ns): "45630"
Process id 25, Scan time (ns): "1256822"
Process id 51, Scan time (ns): "52351290"
Process id 30, Scan time (ns): "90257651"
Process id 19, Scan time (ns): "178764794932"

Answer 1

Here is another approach. It uses sed and sort:
sed '/^Process id:/h; /^Scan time (ns):/!d; s/"//g; H; x; s/\n/, /' file | sort -k7,7n
Note: I've removed double quotes around the scan time values (double quotes around integer values make little sense to me).

Answer 2

With your shown samples please try following awk code. Written and tested in GNU awk.
awk '
/^Process id: /{
val=$NF
next
}
/^Scan time \(ns\): "/{
arr[val]=$NF
}
END{
PROCINFO["sorted_in"]="#ind_num_asc"
for(i in arr){
print "Process id " i ", Scan time (ns): " arr[i]""
}
}
' Input_file

Answer 3

Using perl to read the records one at a time (Using "paragraph mode" which uses a blank line as a record seperator), extract the time, and sort in reverse order by it:
$ perl -00 -lne 'm/Scan time \(ns\):\s+"(\d+)"/ && push #procs, [ $_, $1 ];
END { print $_->[0] for sort { $a->[1] < $b->[1] } #procs }' input.txt
Process id: 86
Name: yyyy
Path: "/usr/libexec/yyyy"
Total files scanned: 2
Scan time (ns): "12761174"
Status: Active
Process id: 25
Name: wwww
Path: "/usr/libexec/wwww"
Total files scanned: 42
Scan time (ns): "62416"
Status: Active
Process id: 7
Name: xxxx
Path: "/usr/libexec/xxxx"
Total files scanned: 0
Scan time (ns): "0"
Status: Active

Answer 4

A combination of awk's RS (input record separator) and FS (input field separator) are useful in this case:
< inpt awk 'BEGIN { RS = ""; FS = "\n" } { print $1 ", " $5 }' | sort -t \" -k2n
Before starting to process anything, i.e in the BEGIN, we set
RS to "", meaning that records are separated by empty lines, and
FS to "\n", meaning that (in each record) the fields are separated by a line break;
then we proceed by printing the 1st and 5th field, with a comma in between.
Finally, interpreting each line of the stream as "-separated list of fields, we sort numerically according to the second field (-k2).

Answer 5

With just paste:
$ cat file | paste - - - - - - -
Process id: 25 Name: wwww Path: "/usr/libexec/wwww" Total files scanned: 42 Scan time (ns): "62416" Status: Active
Process id: 7 Name: xxxx Path: "/usr/libexec/xxxx" Total files scanned: 0 Scan time (ns): "0" Status: Active
Process id: 86 Name: yyyy Path: "/usr/libexec/yyyy" Total files scanned: 2 Scan time (ns): "12761174" Status: Active
And if we add some formatting:
$ cat file \
| paste - - - - - - - \
| awk '{
printf("process id: %s, scan time (ns): %s\n", $3, $15);
}'
process id: 25, scan time (ns): "62416"
process id: 7, scan time (ns): "0"
process id: 86, scan time (ns): "12761174"
Those are 7 dashes (-), because each one of your records is 7 lines (including the blank line).
Explanation of the hack:
paste will concatenate the 1st line of all input files into a single line, then concatenate the 2nd line and so on.
So for each input file, in order, it reads a line and adds it to it's current output line.
We've given stdin as input, 7 times. But stdin is a single stream.
So paste will do:
read line 1 from input 1 (line 1 of stdin)
read line 1 from input 2 (line 2 of stdin)
...
read line 1 from input 7 (line 7 of stdin)
concatenate these lines (lines 1-7 of stdin) as line 1 of stdout
read line 2 from input 1 (line 8 of stdin)
...
read line 2 from input 7 (line 14 of stdin)
concatenate these lines (lines 8-14 of stdin) as line 2 of stdout
...