UNIX for Dummies Questions & Answers

Help Please!

I have alot of text that I would like to count for a range of text.

logevents.1:<190> Oct 30 02:59:42 N/A [23]: 6|4145|RC|CAC: Terminated
logevents.1:<190> Oct 30 02:59:42 N/A [23]: 6|4097|RC|CAC: Deleted
logevents.1:<190> Oct 30 02:59:44 N/A [36]: 6|4145|RC|CAC: Terminated
logevents.1:<190> Oct 30 02:59:44 N/A [36]: 6|4097|RC|CAC: Deleted
logevents.1:<190> Oct 30 02:59:46 N/A [23]: 6|4096|RC|CAC: Created
logevents.1:<190> Oct 30 03:00:01 N/A [36]: 6|4096|RC|CAC: Created
logevents.1:<190> Oct 30 03:00:05 N/A [23]: 6|4145|RC|CAC: Terminated
logevents.1:<190> Oct 30 03:00:05 N/A [23]: 6|4097|RC|CAC: Deleted
logevents.1:<190> Oct 30 03:00:06 N/A [36]: 6|4145|RC|CAC: Terminated
logevents.1:<190> Oct 30 03:00:06 N/A [36]: 6|4097|RC|CAC: Deleted
logevents.1:<190> Oct 30 03:00:06 N/A [23]: 6|4145|RC|CAC: Terminated

I would like to count how many times per hour the word Created showed up.
So I guess I am looking for something that will search on Oct 30 00 through Oct 30 23 that also had the word Created on that line.

any help would be great, thanks
Brian

Assuming no trailing spaces in the above file:

Code:

grep 'Created$' filename | grep 'Oct 30' | wc -l | read cnt
echo " $cnt /24 " | bc -l

This gives an average per hour - is that what you want?

I added a couple more "Created" into my file, so I could see more/better results.

Code:

> awk '$8=="Created" {print $2,$3,substr($4,1,2),$8}' file27
Oct 30 02 Created
Oct 30 03 Created
Oct 30 03 Created
Oct 30 04 Created
Oct 30 04 Created
Oct 30 04 Created
Oct 30 04 Created

Above shows the "Created" in a few more lines

Code:

> awk '$8=="Created" {print $2,$3,substr($4,1,2),$8}' file27 | sort | uniq -c
      1 Oct 30 02 Created
      2 Oct 30 03 Created
      4 Oct 30 04 Created

Above give a count, then the month day hour

something like:

Code:

 awk '/Oct 30.*Created/{c++}END{print c}' file1

or more simply

Code:

grep -c "Oct 30.*Created" file1

should suffice

joeyg
That worked perfectly
Thanks a bunch
Brian

Use nawk or /usr/xpg4/bin/awk on Solaris:

Code:

awk 'END { 
  print h, c 
  }
!_[$2 FS $3 FS substr($4,1,2)]++ && NR > 1 { 
  print h, c 
  c = 0 
  }
{ 
  h = $2 FS $3 FS substr($4,1,2)
    if ($NF ~ /Created/) 
      c++ 
  }' infile