0

I have following command output

$ /opt/CrowdStrike/falconctl -g --aid | grep 'aid='
aid="fdwe234wfgrgf34tfsf23rwefwef3".

I want to check if there is any string after aid= (inside ""). If there is any string, command return code should be 0 and if no value return code must be !=0.

Can someone please help to extend this command to get required output?

Idea is to make sure my bash script to fail if aid= doesn't has any value.

7
  • You could use grep -q, which has exactly the exit status behaviour you describe: falconctl -g aid | grep -q 'aid="[^"]*YOURSTRING[^"]*"' Commented Dec 22, 2022 at 17:38
  • Or are you looking for "not empty", and not a specific string? Commented Dec 22, 2022 at 17:38
  • 2
    falconctl ... | grep -q 'aid="..*"' might be what you want. Commented Dec 22, 2022 at 17:52
  • 1
    could you update the question to show an example of what 'no value' looks like ... aid=""? aid=? something else? Commented Dec 22, 2022 at 18:22
  • 1
    @hlesnt395h It matches if there is at least one character enclosed in double quotes. Commented Dec 23, 2022 at 12:23

2 Answers 2

2

You can use regex to check whether one or more characters exist inside the double quotes. And, you can use regex capture group to extract that value:

if [[ $(/opt/CrowdStrike/falconctl -g --aid | grep 'aid=') =~ ^aid=\"(.+)\"$ ]]; then
  aid=${BASH_REMATCH[0]}
  echo "aid is $aid"
else
  echo "aid not found"
fi

Note that the regex I use is .+ which means 1 or more characters, since you require the string to be non-empty. This is in contrast of the usual .* regex which would have be 0 or more characters.

Sign up to request clarification or add additional context in comments.

Comments

1

I don't have falconctl on my system so to mimic its output I'll use a couple files:

$ head falcon*out
==> falcon.1.out <==
some stuff
aid="fdwe234wfgrgf34tfsf23rwefwef3".
some more stuff

==> falcon.2.out <==
some stuff
aid=""
some more stuff

One grep idea:

grep -Eq '^aid="[^"]+"' <filename>

Where:

  • -E - enable extended regex support
  • -q - run in silent/quiet mode (suppress all output)
  • the return code can be captured from $?

Taking for a test drive:

for fname in falcon*out
do
    printf "\n############# %s\n" "$fname"
    cat "$fname" | grep -Eq '^aid="[^"]+"' "$fname"
    echo "return code: $?"
done

This generates:

############# falcon.1.out
return code: 0

############# falcon.2.out
return code: 1

1 Comment

Thanks a lot for your reply. Let me try this out and come back here.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.