Ok. So we now know that the gawk script is seeing the date and time 02/Jul/2015:01:55:57 but is generating a seconds since the Epoch value that corresponds to the date and time Tue Jun 2 01:55:57 EDT 2015.

Try changing the following line in your script:

Code:

  mnum=int(index("JanFebMarAprMayJunJulAugSepOctNovDec", v[3])/3)

to:

Code:

  mnum=index("xxJanFebMarAprMayJunJulAugSepOctNovDec", v[3])/3

and run it again.

With any luck, this should work for you. Then you need to search your log files for a few log entries that that were created when daylight savings time was not in effect. Do you still have any log files that were created before daylight savings time went into effect this year? They should be easy to find with:

Code:

fgrep '-0500]' /data/log/*.log

If the fgrep found any entries like that, they won't be included in the counts using your current script. If fgrep didn't find anything, you need to determine if that is because you don't have any log entries that old, or if something else is changing the date format for those entries. If any lines were found, sanitize two or three of them and add them to the file /data/log/test.log and show them to us so we can devise a time range to select one or two of them.

My guess would be that you'll need to change the line:

Code:

$5 == "-0400]" {

to one of the two following lines:

Code:

$5 == "-0400]" || $5 == "-0500]" {
      or
$5 ~ "-0[45]00]" {

to reliably process all of your input for the US Eastern time zone, but we'll need a couple of sample lines to verify that it does works correctly for both daylight savings time and standard time.