Login or Register to Ask a Question and Join Our Community


Shell Programming and Scripting

awk related question

Login to Discuss or Reply to this Discussion in Our Community

 
Thread Tools Search this Thread
Top Forums Shell Programming and Scripting awk related question
# 1  
Old 04-02-2012
awk related question
Code:
awk "/^<Mar 31, 2012 [1-12]:[0-59] /,0" /app/blah.log

can someone please help me figure out why the above command isn't pulling anything out from the log?

basically, i want it to pull out all records, from the very first line that starts with the date "Mar 31, 2012" and that also has a time immediately following the date, to the end of the log file.

i tried to specify "[1-12]:[0-59]" to represent the range of timestamps, but frankly, that simply isn't doing the trick.

any ideas?
# 2  
Old 04-02-2012
[] brackets don't match ranges of numbers, they match ranges of characters.

If the line starts with 'Mar', it certainly doesn't start with <.

I have no idea what the ",0" is for, there.

I'm only guessing since you didn't post any of the data you wanted matched, but:

Code:
/^Mar 31, 2012 (0[1-9]|1[0-2]):[0-5][0-9]/

Please post a sample of your input data.
# 3  
Old 04-02-2012
Quote:
Originally Posted by Corona688
[] brackets don't match ranges of numbers, they match ranges of characters.

If the line starts with 'Mar', it certainly doesn't start with <.

I have no idea what the ",0" is for, there.

I'm only guessing since you didn't post any of the data you wanted matched, but:

Code:
/^Mar 31, 2012 (0[1-9]|1[0-2]):[0-5][0-9]/

Please post a sample of your input data.

sample line in log file:

Code:
<Mar 31, 2012 6:40:40 PM UTC> <Warning> <Socket> <BEA-00670450> <Socket 211 internal data record unavailable (probable closure due idle timeout), event received 17>

# 4  
Old 04-02-2012
Hmm, I can probably adapt the solution from this thread. Too bad it doesn't use 24hr time. Working on it.
# 5  
Old 04-02-2012
If you can get a date into YYYY MM DD HH MM SS order with 24-hour time, and month+day+hour+minute+second as two digits with leading zeroes, then they compare alphabetically. Since < = > compare alphabetically, this is very convenient!

So that is what I do -- reorder the dates into something that can be easily compared, then compare it.
Code:
$ cat drange.awk

BEGIN { split("Jan Feb Mar Apr May Jun Jul Aug Sep Oct Nov Dec", M);
        # Store them as MON["<Jan"]=1
        for(X in M) MON["<"M[X]]=X;     }

{ CMP="" }

MON[$1] {
        # Convert 12-hour time into 24-hour time
        split($4, T, ":");
        if(($5 == "AM") && (T[1]=="12")) T[1]=0;
        else if($5 == "PM")
        {
                T[1] %= 12;
                T[1] += 12;
        }

        # Reorder date into alphabetically-sortable YYYY MM DD HH MM SS
        CMP=sprintf("%04d %02d %02d %02d:%02d:%02d", $3,
                MON[$1], $2, T[1], T[2], T[3]);
}

CMP && (CMP>=START)

$ cat data

<Mar 31, 2012 12:40:40 AM UTC> <Warning> <Socket> <BEA-00670450> <Socket 211 internal data record unavailable (probable closure due idle timeout), event received 17>
<Mar 31, 2012 1:40:40 AM UTC> <Warning> <Socket> <BEA-00670450> <Socket 211 internal data record unavailable (probable closure due idle timeout), event received 17>
<Mar 31, 2012 2:40:40 AM UTC> <Warning> <Socket> <BEA-00670450> <Socket 211 internal data record unavailable (probable closure due idle timeout), event received 17>
<Mar 31, 2012 3:40:40 AM UTC> <Warning> <Socket> <BEA-00670450> <Socket 211 internal data record unavailable (probable closure due idle timeout), event received 17>
<Mar 31, 2012 4:40:40 AM UTC> <Warning> <Socket> <BEA-00670450> <Socket 211 internal data record unavailable (probable closure due idle timeout), event received 17>
<Mar 31, 2012 5:40:40 AM UTC> <Warning> <Socket> <BEA-00670450> <Socket 211 internal data record unavailable (probable closure due idle timeout), event received 17>
<Mar 31, 2012 6:40:40 AM UTC> <Warning> <Socket> <BEA-00670450> <Socket 211 internal data record unavailable (probable closure due idle timeout), event received 17>
<Mar 31, 2012 7:40:40 AM UTC> <Warning> <Socket> <BEA-00670450> <Socket 211 internal data record unavailable (probable closure due idle timeout), event received 17>
<Mar 31, 2012 8:40:40 AM UTC> <Warning> <Socket> <BEA-00670450> <Socket 211 internal data record unavailable (probable closure due idle timeout), event received 17>
<Mar 31, 2012 9:40:40 AM UTC> <Warning> <Socket> <BEA-00670450> <Socket 211 internal data record unavailable (probable closure due idle timeout), event received 17>
<Mar 31, 2012 10:40:40 AM UTC> <Warning> <Socket> <BEA-00670450> <Socket 211 internal data record unavailable (probable closure due idle timeout), event received 17>
<Mar 31, 2012 11:40:40 AM UTC> <Warning> <Socket> <BEA-00670450> <Socket 211 internal data record unavailable (probable closure due idle timeout), event received 17>
<Mar 31, 2012 12:40:40 PM UTC> <Warning> <Socket> <BEA-00670450> <Socket 211 internal data record unavailable (probable closure due idle timeout), event received 17>
<Mar 31, 2012 1:40:40 PM UTC> <Warning> <Socket> <BEA-00670450> <Socket 211 internal data record unavailable (probable closure due idle timeout), event received 17>
<Mar 31, 2012 2:40:40 PM UTC> <Warning> <Socket> <BEA-00670450> <Socket 211 internal data record unavailable (probable closure due idle timeout), event received 17>
<Mar 31, 2012 3:40:40 PM UTC> <Warning> <Socket> <BEA-00670450> <Socket 211 internal data record unavailable (probable closure due idle timeout), event received 17>
<Mar 31, 2012 4:40:40 PM UTC> <Warning> <Socket> <BEA-00670450> <Socket 211 internal data record unavailable (probable closure due idle timeout), event received 17>
<Mar 31, 2012 5:40:40 PM UTC> <Warning> <Socket> <BEA-00670450> <Socket 211 internal data record unavailable (probable closure due idle timeout), event received 17>
<Mar 31, 2012 6:40:40 PM UTC> <Warning> <Socket> <BEA-00670450> <Socket 211 internal data record unavailable (probable closure due idle timeout), event received 17>
<Mar 31, 2012 7:40:40 PM UTC> <Warning> <Socket> <BEA-00670450> <Socket 211 internal data record unavailable (probable closure due idle timeout), event received 17>
<Mar 31, 2012 8:40:40 PM UTC> <Warning> <Socket> <BEA-00670450> <Socket 211 internal data record unavailable (probable closure due idle timeout), event received 17>
<Mar 31, 2012 9:40:40 PM UTC> <Warning> <Socket> <BEA-00670450> <Socket 211 internal data record unavailable (probable closure due idle timeout), event received 17>
<Mar 31, 2012 10:40:40 PM UTC> <Warning> <Socket> <BEA-00670450> <Socket 211 internal data record unavailable (probable closure due idle timeout), event received 17>
<Mar 31, 2012 11:40:40 PM UTC> <Warning> <Socket> <BEA-00670450> <Socket 211 internal data record unavailable (probable closure due idle timeout), event received 17>

$ awk -v START="2012 03 31 18:40:40" -f drange.awk data

<Mar 31, 2012 6:40:40 PM UTC> <Warning> <Socket> <BEA-00670450> <Socket 211 internal data record unavailable (probable closure due idle timeout), event received 17>
<Mar 31, 2012 7:40:40 PM UTC> <Warning> <Socket> <BEA-00670450> <Socket 211 internal data record unavailable (probable closure due idle timeout), event received 17>
<Mar 31, 2012 8:40:40 PM UTC> <Warning> <Socket> <BEA-00670450> <Socket 211 internal data record unavailable (probable closure due idle timeout), event received 17>
<Mar 31, 2012 9:40:40 PM UTC> <Warning> <Socket> <BEA-00670450> <Socket 211 internal data record unavailable (probable closure due idle timeout), event received 17>
<Mar 31, 2012 10:40:40 PM UTC> <Warning> <Socket> <BEA-00670450> <Socket 211 internal data record unavailable (probable closure due idle timeout), event received 17>
<Mar 31, 2012 11:40:40 PM UTC> <Warning> <Socket> <BEA-00670450> <Socket 211 internal data record unavailable (probable closure due idle timeout), event received 17>

$

You could easily enough add a FINISH variable too, to check if CMP is less than or equal to it, to only select a range in time instead of the whole file.
This User Gave Thanks to Corona688 For This Post:
SkySmart
Login or Register to Ask a Question

Previous Thread | Next Thread

10 More Discussions You Might Find Interesting

1. UNIX for Dummies Questions & Answers

Question related to grep

We have huge file with control A as delimiter. Somehow one record is corrupted. This time i figured it out using ETL graph. If future , how to print only bad record. Example Correct record:... (2 Replies)
Discussion started by: srikanth38
2 Replies

2. Shell Programming and Scripting

awk related question

awk -F ";" 'FNR==NR{a=$1;next} ($2 in a)' server.list datafile | while read line do echo ${line} done when i run the above, i get this: 1 SERVICE NOTIFICATION: nagiosadmin skysmart-01.sky.net .... instead of: SERVICE NOTIFICATION: nagiosadmin skysmart-01.sky.net .... can... (4 Replies)
Discussion started by: SkySmart
4 Replies

3. Shell Programming and Scripting

awk related question (for loop) difficult scenario

VARA='hello|welcome|gone|fantastic|superb|nicecar' if VARA contains a pipe "|", i want the contents of VARA to be tranformed to: VARA="(hello) (welcome) (gone) (fantastic) (superb) (nicecar)" so that, when i echo the contents of $VARA like this: echo "$VARA" or like this: print... (8 Replies)
Discussion started by: SkySmart
8 Replies

4. UNIX for Dummies Questions & Answers

Question related to 'ps'

If I run a script called 'abc.sh' and then execute the following : ps -ef | grep 'abc.sh' I always get two rows of output, one for the executing script, and the other for the grep command that I have triggered after the pipe. Questions: Why does the second row turn up in the results. My... (10 Replies)
Discussion started by: jawsnnn
10 Replies

5. Shell Programming and Scripting

Perl related question

hi, iam perl begginer,i have written the program #!/usr/bin/perl #use warnings; use strict; print "Enter the name:","\n"; my $name=<STDIN>; my %hash=(siva => "9902774481", dev => "9916391244", venky => "9440506760", manohar => "9440232695" ); print "$name no is:... (5 Replies)
Discussion started by: siva.hardwork
5 Replies

6. Shell Programming and Scripting

having df command related question

Hi All, When i have run the below command its showing 90% which is critical for production. for this i need the answer of some below question please help me for that. 1) i want to delete some unwanted files. how can i know the unwanted files ?Is it there any way of knowing this?? 2)and... (2 Replies)
Discussion started by: aish11
2 Replies

7. Shell Programming and Scripting

Question related to sed or awk or perl

Hi All, I have a big file of 100,000 lines with the following format: 1,736870,736870,1,2,5,547,1253889535,1253889775,240,30,152.163.141.8,US,0,00,-g 1253889445 1,881246,881246,1,2,6,402,1253889535,1253889775,240,30,152.163.141.8,US,0,00,-g 1253889445... (4 Replies)
Discussion started by: toms
4 Replies

8. Solaris

RBAC related question.....

I am referring Bill Calkins(SCSA exam prep) for RBAC..actually i wanted to make a normal user to get the privilege to run a command through authorization, not through profile files... This is the exact steps given by Bill calkins.. 1.roleadd -m -d /export/home/adminusr -c... (11 Replies)
Discussion started by: saagar
11 Replies

9. UNIX for Advanced & Expert Users

One Question related to alias

Hello, I have created following alias in csh lab 'rlogin -l user23 complab23' but problem is complab23 does not allow automatic login by checking .rhosts file. So after typing lab on command line I have to type complicate password and if wrong password is typed thrice then account gets... (4 Replies)
Discussion started by: neerajrathi2
4 Replies

10. UNIX for Dummies Questions & Answers

A Question related to the net

well, I was suggested to remove the contents of the cache as i get out of the browser netscape from the .netscape folder. is that really necessary? if so what are the rest to be done? can anybody please tell me?:rolleyes: (8 Replies)
Discussion started by: sskb
8 Replies
Login or Register to Ask a Question