Expanding on what RudiC has already said...

Your first post said absolutely nothing about time of day having any effect on the transactions that should be displayed; it said the only requirement was that the transaction ID should be between 00 and 12.

I know that many people like to write awk one-liners, instead of writing awk scripts such that you can see the structure of the code and easily spot cases where you have invalid conditions in an awk:

Code:

condition { action }

because an if statement is not a valid condition.

But, even if we changed:

Code:

if($3=="time=[0-1][0-9]*") {print trn","nm","tme","msg}

to:

Code:

$3=="time=[0-1][0-9]*" {print trn","nm","tme","msg}

this is a literal string match; not a regular expression match. And, if we changed it to a regular expression match:

Code:

i$3~"time=[0-1][0-9]*" {print trn","nm","the","msg}

that would match transactions that had a time value starting with any value in the range 00 through 19, inclusive.

And, you have another logic error, because $1, $2, $3, and $4 do not have any defined value before the 1st input line has been read (and the BEGIN clause in your awk script is executed before the 1st line of input is read).

If the transaction ID doesn't matter and the only selection criteria for printing records is that the time value starts with 07, you might want something more like:

Code:

awk '
BEGIN {	FS = "\n"
	OFS = ","
	RS = "eof"
}
$3 ~ "=07" {
	print $1, $2, $3, $4
}' log

although this is untested (since the awk on my system does not support multi-character record separators) and it isn't obvious to me whether the <newline> following the eof record separator produces an empty 1st field in records after the 1st record.