assumes that $upstream_cache_status is at the end of the log line: tail -n 50000 access.log | \ grep -v heartbeat | \ awk 'BEGIN {C=0;T=0; } {if ( $NF == "HIT" || $NF=="EXPIRED" ) { C = C + 1 }; T=T+1} END { print C,T,C/T*100 }' Output: 45454 49550 91.7336