Visit Our UNIX and Linux User Community


awk related question


 
Thread Tools Search this Thread
Top Forums Shell Programming and Scripting awk related question
# 1  
Old 04-02-2012
awk related question

Code:
awk "/^<Mar 31, 2012 [1-12]:[0-59] /,0" /app/blah.log

can someone please help me figure out why the above command isn't pulling anything out from the log?

basically, i want it to pull out all records, from the very first line that starts with the date "Mar 31, 2012" and that also has a time immediately following the date, to the end of the log file.

i tried to specify "[1-12]:[0-59]" to represent the range of timestamps, but frankly, that simply isn't doing the trick.

any ideas?
# 2  
Old 04-02-2012
[] brackets don't match ranges of numbers, they match ranges of characters.

If the line starts with 'Mar', it certainly doesn't start with <.

I have no idea what the ",0" is for, there.

I'm only guessing since you didn't post any of the data you wanted matched, but:

Code:
/^Mar 31, 2012 (0[1-9]|1[0-2]):[0-5][0-9]/

Please post a sample of your input data.
# 3  
Old 04-02-2012
Quote:
Originally Posted by Corona688
[] brackets don't match ranges of numbers, they match ranges of characters.

If the line starts with 'Mar', it certainly doesn't start with <.

I have no idea what the ",0" is for, there.

I'm only guessing since you didn't post any of the data you wanted matched, but:

Code:
/^Mar 31, 2012 (0[1-9]|1[0-2]):[0-5][0-9]/

Please post a sample of your input data.

sample line in log file:

Code:
<Mar 31, 2012 6:40:40 PM UTC> <Warning> <Socket> <BEA-00670450> <Socket 211 internal data record unavailable (probable closure due idle timeout), event received 17>

# 4  
Old 04-02-2012
Hmm, I can probably adapt the solution from this thread. Too bad it doesn't use 24hr time. Working on it.
# 5  
Old 04-02-2012
If you can get a date into YYYY MM DD HH MM SS order with 24-hour time, and month+day+hour+minute+second as two digits with leading zeroes, then they compare alphabetically. Since < = > compare alphabetically, this is very convenient!

So that is what I do -- reorder the dates into something that can be easily compared, then compare it.
Code:
$ cat drange.awk

BEGIN { split("Jan Feb Mar Apr May Jun Jul Aug Sep Oct Nov Dec", M);
        # Store them as MON["<Jan"]=1
        for(X in M) MON["<"M[X]]=X;     }

{ CMP="" }

MON[$1] {
        # Convert 12-hour time into 24-hour time
        split($4, T, ":");
        if(($5 == "AM") && (T[1]=="12")) T[1]=0;
        else if($5 == "PM")
        {
                T[1] %= 12;
                T[1] += 12;
        }

        # Reorder date into alphabetically-sortable YYYY MM DD HH MM SS
        CMP=sprintf("%04d %02d %02d %02d:%02d:%02d", $3,
                MON[$1], $2, T[1], T[2], T[3]);
}

CMP && (CMP>=START)

$ cat data

<Mar 31, 2012 12:40:40 AM UTC> <Warning> <Socket> <BEA-00670450> <Socket 211 internal data record unavailable (probable closure due idle timeout), event received 17>
<Mar 31, 2012 1:40:40 AM UTC> <Warning> <Socket> <BEA-00670450> <Socket 211 internal data record unavailable (probable closure due idle timeout), event received 17>
<Mar 31, 2012 2:40:40 AM UTC> <Warning> <Socket> <BEA-00670450> <Socket 211 internal data record unavailable (probable closure due idle timeout), event received 17>
<Mar 31, 2012 3:40:40 AM UTC> <Warning> <Socket> <BEA-00670450> <Socket 211 internal data record unavailable (probable closure due idle timeout), event received 17>
<Mar 31, 2012 4:40:40 AM UTC> <Warning> <Socket> <BEA-00670450> <Socket 211 internal data record unavailable (probable closure due idle timeout), event received 17>
<Mar 31, 2012 5:40:40 AM UTC> <Warning> <Socket> <BEA-00670450> <Socket 211 internal data record unavailable (probable closure due idle timeout), event received 17>
<Mar 31, 2012 6:40:40 AM UTC> <Warning> <Socket> <BEA-00670450> <Socket 211 internal data record unavailable (probable closure due idle timeout), event received 17>
<Mar 31, 2012 7:40:40 AM UTC> <Warning> <Socket> <BEA-00670450> <Socket 211 internal data record unavailable (probable closure due idle timeout), event received 17>
<Mar 31, 2012 8:40:40 AM UTC> <Warning> <Socket> <BEA-00670450> <Socket 211 internal data record unavailable (probable closure due idle timeout), event received 17>
<Mar 31, 2012 9:40:40 AM UTC> <Warning> <Socket> <BEA-00670450> <Socket 211 internal data record unavailable (probable closure due idle timeout), event received 17>
<Mar 31, 2012 10:40:40 AM UTC> <Warning> <Socket> <BEA-00670450> <Socket 211 internal data record unavailable (probable closure due idle timeout), event received 17>
<Mar 31, 2012 11:40:40 AM UTC> <Warning> <Socket> <BEA-00670450> <Socket 211 internal data record unavailable (probable closure due idle timeout), event received 17>
<Mar 31, 2012 12:40:40 PM UTC> <Warning> <Socket> <BEA-00670450> <Socket 211 internal data record unavailable (probable closure due idle timeout), event received 17>
<Mar 31, 2012 1:40:40 PM UTC> <Warning> <Socket> <BEA-00670450> <Socket 211 internal data record unavailable (probable closure due idle timeout), event received 17>
<Mar 31, 2012 2:40:40 PM UTC> <Warning> <Socket> <BEA-00670450> <Socket 211 internal data record unavailable (probable closure due idle timeout), event received 17>
<Mar 31, 2012 3:40:40 PM UTC> <Warning> <Socket> <BEA-00670450> <Socket 211 internal data record unavailable (probable closure due idle timeout), event received 17>
<Mar 31, 2012 4:40:40 PM UTC> <Warning> <Socket> <BEA-00670450> <Socket 211 internal data record unavailable (probable closure due idle timeout), event received 17>
<Mar 31, 2012 5:40:40 PM UTC> <Warning> <Socket> <BEA-00670450> <Socket 211 internal data record unavailable (probable closure due idle timeout), event received 17>
<Mar 31, 2012 6:40:40 PM UTC> <Warning> <Socket> <BEA-00670450> <Socket 211 internal data record unavailable (probable closure due idle timeout), event received 17>
<Mar 31, 2012 7:40:40 PM UTC> <Warning> <Socket> <BEA-00670450> <Socket 211 internal data record unavailable (probable closure due idle timeout), event received 17>
<Mar 31, 2012 8:40:40 PM UTC> <Warning> <Socket> <BEA-00670450> <Socket 211 internal data record unavailable (probable closure due idle timeout), event received 17>
<Mar 31, 2012 9:40:40 PM UTC> <Warning> <Socket> <BEA-00670450> <Socket 211 internal data record unavailable (probable closure due idle timeout), event received 17>
<Mar 31, 2012 10:40:40 PM UTC> <Warning> <Socket> <BEA-00670450> <Socket 211 internal data record unavailable (probable closure due idle timeout), event received 17>
<Mar 31, 2012 11:40:40 PM UTC> <Warning> <Socket> <BEA-00670450> <Socket 211 internal data record unavailable (probable closure due idle timeout), event received 17>

$ awk -v START="2012 03 31 18:40:40" -f drange.awk data

<Mar 31, 2012 6:40:40 PM UTC> <Warning> <Socket> <BEA-00670450> <Socket 211 internal data record unavailable (probable closure due idle timeout), event received 17>
<Mar 31, 2012 7:40:40 PM UTC> <Warning> <Socket> <BEA-00670450> <Socket 211 internal data record unavailable (probable closure due idle timeout), event received 17>
<Mar 31, 2012 8:40:40 PM UTC> <Warning> <Socket> <BEA-00670450> <Socket 211 internal data record unavailable (probable closure due idle timeout), event received 17>
<Mar 31, 2012 9:40:40 PM UTC> <Warning> <Socket> <BEA-00670450> <Socket 211 internal data record unavailable (probable closure due idle timeout), event received 17>
<Mar 31, 2012 10:40:40 PM UTC> <Warning> <Socket> <BEA-00670450> <Socket 211 internal data record unavailable (probable closure due idle timeout), event received 17>
<Mar 31, 2012 11:40:40 PM UTC> <Warning> <Socket> <BEA-00670450> <Socket 211 internal data record unavailable (probable closure due idle timeout), event received 17>

$

You could easily enough add a FINISH variable too, to check if CMP is less than or equal to it, to only select a range in time instead of the whole file.
This User Gave Thanks to Corona688 For This Post:

Previous Thread | Next Thread
Test Your Knowledge in Computers #625
Difficulty: Medium
Functions are defined using the defineFunction reserved keyword in Python.
True or False?

10 More Discussions You Might Find Interesting

1. UNIX for Dummies Questions & Answers

Question related to grep

We have huge file with control A as delimiter. Somehow one record is corrupted. This time i figured it out using ETL graph. If future , how to print only bad record. Example Correct record:... (2 Replies)
Discussion started by: srikanth38
2 Replies

2. Shell Programming and Scripting

awk related question

awk -F ";" 'FNR==NR{a=$1;next} ($2 in a)' server.list datafile | while read line do echo ${line} done when i run the above, i get this: 1 SERVICE NOTIFICATION: nagiosadmin skysmart-01.sky.net .... instead of: SERVICE NOTIFICATION: nagiosadmin skysmart-01.sky.net .... can... (4 Replies)
Discussion started by: SkySmart
4 Replies

3. Shell Programming and Scripting

awk related question (for loop) difficult scenario

VARA='hello|welcome|gone|fantastic|superb|nicecar' if VARA contains a pipe "|", i want the contents of VARA to be tranformed to: VARA="(hello) (welcome) (gone) (fantastic) (superb) (nicecar)" so that, when i echo the contents of $VARA like this: echo "$VARA" or like this: print... (8 Replies)
Discussion started by: SkySmart
8 Replies

4. UNIX for Dummies Questions & Answers

Question related to 'ps'

If I run a script called 'abc.sh' and then execute the following : ps -ef | grep 'abc.sh' I always get two rows of output, one for the executing script, and the other for the grep command that I have triggered after the pipe. Questions: Why does the second row turn up in the results. My... (10 Replies)
Discussion started by: jawsnnn
10 Replies

5. Shell Programming and Scripting

Perl related question

hi, iam perl begginer,i have written the program #!/usr/bin/perl #use warnings; use strict; print "Enter the name:","\n"; my $name=<STDIN>; my %hash=(siva => "9902774481", dev => "9916391244", venky => "9440506760", manohar => "9440232695" ); print "$name no is:... (5 Replies)
Discussion started by: siva.hardwork
5 Replies

6. Shell Programming and Scripting

having df command related question

Hi All, When i have run the below command its showing 90% which is critical for production. for this i need the answer of some below question please help me for that. 1) i want to delete some unwanted files. how can i know the unwanted files ?Is it there any way of knowing this?? 2)and... (2 Replies)
Discussion started by: aish11
2 Replies

7. Shell Programming and Scripting

Question related to sed or awk or perl

Hi All, I have a big file of 100,000 lines with the following format: 1,736870,736870,1,2,5,547,1253889535,1253889775,240,30,152.163.141.8,US,0,00,-g 1253889445 1,881246,881246,1,2,6,402,1253889535,1253889775,240,30,152.163.141.8,US,0,00,-g 1253889445... (4 Replies)
Discussion started by: toms
4 Replies

8. Solaris

RBAC related question.....

I am referring Bill Calkins(SCSA exam prep) for RBAC..actually i wanted to make a normal user to get the privilege to run a command through authorization, not through profile files... This is the exact steps given by Bill calkins.. 1.roleadd -m -d /export/home/adminusr -c... (11 Replies)
Discussion started by: saagar
11 Replies

9. UNIX for Advanced & Expert Users

One Question related to alias

Hello, I have created following alias in csh lab 'rlogin -l user23 complab23' but problem is complab23 does not allow automatic login by checking .rhosts file. So after typing lab on command line I have to type complicate password and if wrong password is typed thrice then account gets... (4 Replies)
Discussion started by: neerajrathi2
4 Replies

10. UNIX for Dummies Questions & Answers

A Question related to the net

well, I was suggested to remove the contents of the cache as i get out of the browser netscape from the .netscape folder. is that really necessary? if so what are the rest to be done? can anybody please tell me?:rolleyes: (8 Replies)
Discussion started by: sskb
8 Replies

Featured Tech Videos