title: awk: create list of destination ports seen for each source IP from a bro log (conn.log)
body: <p>I'm trying to solve a problem in awk as an exercise but I'm having trouble. 
  I want awk (or gawk) to be able to print all <em>unique</em> destination ports for a particular source IP address. <br> <br>
  The source IP address is field 1 ($1) and the destination port is field 4 ($4).</p>
  
  <pre><code>Cut for brevity:
  SourceIP          SrcPort   DstIP           DstPort
  192.168.1.195       59508   98.129.121.199  80
  192.168.1.87        64802   192.168.1.2     53
  10.1.1.1            41170   199.253.249.63  53
  10.1.1.1            62281   204.14.233.9    443
  </code></pre>
  
  <p>I imagine you would store each Source IP as in index to an array. But I'm not quite sure how you would store destination ports as values. Maybe you can keep appending to a string, being the value of the index e.g. "80,"..."80,443,"... for each match. But maybe that's not the best solution.</p>
  
  <p>I'm not too concerned about output, I really just want to see how one can approach this in awk. Though, for output I was thinking something like,</p>
  
  <pre><code>Source IP:dstport, dstport, dstport
  192.168.1.195:80,443,8088,5900
  </code></pre>
  
  <p>I'm tinkering with something like this,</p>
  
  <pre><code>awk '{ if ( NR == 1) next; arr[$1,$4] = $4 } END { for (i in arr) print arr[i] }' infile
  </code></pre>
  
  <p>but cannot figure out how to print out the elements and their values for a two-dimensional array. It seems something along this line would take care of the unique destination port task because each port is overwriting the value of the element. </p>
  
  <p><b>Note:</b> <b>awk/gawk</b> solution will get the answer!</p>
  
  <p><b>Solution EDIT:</b> slightly modified Kent's solution to print unique destination ports as mentioned in my question and to skip the column header line.</p>
  
  <pre><code>awk '{ if ( NR == 1 ) next ; if ( a[$1] &amp;&amp; a[$1] !~ $4 ) a[$1] = a[$1]","$4; else a[$1] = $4 } END {for(x in a)print x":"a[x]}'
  </code></pre>