rwappend - Append SiLK Flow file(s) to an existing SiLK Flow file


  rwappend [--create=[TEMPLATE_FILE]] [--print-statistics]

  rwappend --help

  rwappend --version


rwappend reads SiLK Flow records from the specified SOURCE_FILEs and appends them to the TARGET_FILE. If stdin is used as the name of one of the SOURCE_FILEs, SiLK flow records will be read from the standard input.

When the TARGET_FILE does not exist and the --create switch is not provided, rwappend will exit with an error. When --create is specified and TARGET_FILE does not exist, rwappend will create the TARGET_FILE using the same format, version, and byte-order as the specified TEMPLATE_FILE. If no TEMPLATE_FILE is given, the TARGET_FILE is created in the default format and version (the same format that rwcat(1) would produce).

The TARGET_FILE must be an actual file---it cannot be a named pipe or the standard output. In addition, the header of TARGET_FILE must not be compressed; that is, you cannot append to a file whose entire contents has been compressed with gzip (those files normally end in the .gz extension).


Option names may be abbreviated if the abbreviation is unique or is an exact match for an option. A parameter to an option may be specified as --arg=param or --arg param, though the first form is required for options that take optional parameters.


Create the TARGET_FILE if it does not exist. The file will have the same format, version, and byte-order as the TEMPLATE_FILE if it is provided; otherwise the defaults are used. The TEMPLATE_FILE will NOT be appended to TARGET_FILE unless it also appears in as the name of a SOURCE_FILE.

Print to the standard error the number of records read from each SOURCE_FILE and the total number of records appended to the TARGET_FILE.


Read the SiLK site configuration from the named file FILENAME. When this switch is not provided, rwappend searches for the site configuration file in the locations specified in the "FILES" section.


Print the available options and exit.


Print the version number and information about how SiLK was configured, then exit the application.


In the following examples, the dollar sign ($) represents the shell prompt. The text after the dollar sign represents the command line. Lines have been wrapped for improved readability, and the back slash (\) is used to indicate a wrapped line.

Standard usage where the file to append to,, exists:

 $ rwappend

To append files sample*.rw to, or to create using the same format as the first file argument (note that must be repeated):

 $ rwappend          \

If does not exist, the following two commands are equivalent:

 $ rwappend --create

 $ rwcat >



This environment variable is used as the value for the --site-config-file when that switch is not provided.


This environment variable specifies the root directory of data repository. As described in the "FILES" section, rwappend may use this environment variable when searching for the SiLK site configuration file.


This environment variable gives the root of the install tree. When searching for configuration files, rwappend may use this environment variable. See the "FILES" section for details.



Possible locations for the SiLK site configuration file which are checked when the --site-config-file switch is not provided.


rwcat(1), silk(7)


When a SOURCE_FILE contains IPv6 flow records and the TARGET_FILE only supports IPv4 records, rwappend converts IPv6 records that contain addresses in the ::ffff:0:0/96 prefix to IPv4 and writes them to the TARGET_FILE. rwappend silently ignores IPv6 records having addresses outside of that prefix.

rwappend makes some attempts to avoid appending a file to itself (which would eventually exhaust the disk space) by comparing the names of files it is given; it should be smarter about this.