[Autogenerated] And do you know what we're going to do?
Now, we're going to take a look at that marvelous begin block.
The begin block is very often used for setting headers,
but we can also use it for setting our fs our field separator variable.
If you take a look at the code here,
we've got arc rather than arc minus upper case F having it included
in our arc statement does also mean that we can include then the
begin block and our field separator inside of an arc script if we
want to use it within an arc script.
So we're not reliant on how the user inputs the information in our begin block.
We've got our field separator equals our colon and then a semicolon.
These are separate statements.
We have the print fs statement as before,
but now we're printing our, our header information,
we then go into the main block that we had before to print out our records.
When we take a look at how we can start modifying our begin block here,
we're adding in and setting a counter variable.
We're declaring it with a value of zero.
So again, we have a semicolon and count equals zero.
When we start looking at our main block.
The first thing we do in our main block is increment the counter.
So we can see how many records actually end in bash.
We then go through our print fs statement as before.
But instead of printing out the N R variable,
we're printing out the value of the count variable.
So now we're able to count the matches of lines ending with bash.
Now, the best way to see this though is to start typing it our ourselves.
So we're going to go through and implement our begin block,
adding in our header information,
setting our field separator variable and adding in our own row counter.
So come on,
let's go through and find that pixel playground as we go through and
just take a look at where we were working with before we can see then
that we're getting our records coming back.
But we can see we don't have any header information and
we've got the one and 23 in my case, if we want to modify this just a little bit,
we can up our, our.
And the first thing that I'm going to do is remove the minus F and colon.
Now, whilst ID do need this to core,
get the correct information you can see now that I'm not detecting my field.
So I do need that.
We don't have to rely on it from the command line input.
We can app array,
go back inside of our single quotes representing our whole AKS statement.
And from this, we can then go through and implement our begin block.
So we write the words begin in upper case and then open up a new block of code.
This is our begin block and we know it's a begin block
because Zeek got the word begin inside of this,
we can then go through and put our fs equals and then in quotes,
our colon, that's easy enough, isn't it?
Even I can manage that.
So now as we look,
we've got back to the correct information that we were working with before.
Now,
I'll say the idea of this is that we could implement this within an arc file.
So we're not reliant on the operator remembering
the minus F switch at the moment, we're going to leave it at the command line.
But later on, once we've finished everything,
we can implement this as an arc file, we want to do a little bit more though,
print that header information that we are missing as well.
We can go through into our begin block and we need to separate our statements.
So we put the semicolon and now we can start our print fs statement.
The print fs statement is going to be very similar to the print fs
statement that we're using to print out in our main block,
but we can combine some fields together.
So let's begin on those format specifiers.
We know we're going to open up our double quotes and per
percent begins any format specifier.
We can specify four width and using a string.
So this allows me to put a four width header that then corresponds
to our line number that we are working with.
Once we've done that, we then need to cater for our user name.
Now that again is going to be a string so we can go through
and specify that with our per percent S but we know we
don't just want a single string.
We're going to be putting 20 characters here.
So 20 width specifier for a string and we're going to
finish up putting in our user id.
But remember all of this is just text information we're passing through.
So we're going to put a six width string for our user ID D header.
Now, don't forget we need to put in our new lines.
So slash N and close off our format specifiers and then
commerce separate all of our input values.
Now,
the first four S that we're putting in is going to
be represented by numb and colon.
Close off our quotes for that,
we can then put a comma to separate the next input and
that's going to be our user name.
So we might as well just write username in quotes
and then we've got our user ID D.
Now with that done, when we look at it, everything is lined up nicely.
We've got the correct width for our headers and the
information that we're seeing all looks very good.
But of course,
we're still seeing that number one and number 23 we might want to
have more of a number relating to the number of users that we have
with bash being their default shell.
So we can implement that as well.
We saw it in the slide, but really to learn it,
we need to implement it ourselves.
So we're going to return to our begin block and we need to put in a
new statement so we can end with the semicolon and then establish
our count variable with a value of zero,
count equals zero.
Now, to make sure,
then we are counting our numbers at the beginning of our main block,
we can increment that counter.
So count plus plus,
don't forget the semicolon because it's a different
statement to the print F statement.
So we first of all increment our counter,
but having incremented our counter,
we can go across to where we've got our line number N our
variable and replace it with our count variable.
Now, when we hit the enter key,
we can see then that we got numbers one and numbers two.
So we've got two users who implement the back shell.
Now, it hasn't changed anything underlying.
We can still uniquely access our users through the user id.
But at least we've got a mechanism of seeing how many users
match the criteria that we've been looking for.
Now, I know we've only had two users.
But you can imagine something a little bit bigger.
There are going to be more users ending in bash.
So it becomes an easy way to count.
But what if we want a summary?
Hm.
Summary.