> 'NR > 2 {split($5,a,":"); One thing you should watch out for is that the IP address could be an IPv6. In that case, you cannot split by ":" because there may be many ":" in the address. So you would need something that parses out the number after the last colon in field 5. But I'm not really good with awk to write that...
Tomas