03/03/2014 12:31:21 BLOCK 10.1.34.1 11:22:33:44:55:66
03/03/2014 12:31:22 ALLOW 10.1.34.2 AA:BB:CC:DD:EE:FF
03/03/2014 12:31:25 BLOCK 10.1.34.1 55:66:77:88:99:AA
<
I tested your statement
awk ' BEGIN {count=0;} { if ($3 == "BLOCK") count+=1} end {print $count}' firewall.log
and was able to successfully count BLOCK by doing two changes
end should be in caps$ from print $countSo, it should be:
awk ' BEGIN {count=0;} { if ($3 == "BLOCK") count+=1} END {print count}' firewall.log
A simpler statement that works too is:
awk '($3 == "BLOCK") {count++ } END { print count }' firewall.log