Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

This question already has an answer here:

How would you search a log file for a date range?

Log file looks like this:

01/14 00:00:01  INFO:     received connect request from 10.10.10.10 

I need to condense the log to 10 minutes starting at 8:25 and going until 8:35

When I use the following egrep I find too many results, such as00:08:25 01:08:25 ... 08:25:00..

How can I just get 08:25:00 through 08:35:59

What I've tried

cat foo | egrep "08:2[5-9]|08:3[0-5]"
cat foo | egrep "08:2[5-9]:??|08:3[0-5]:??"
cat foo | egrep "08:2[5-9]:[0-9][0-9]|08:3[0-5]:[0-9][0-9]"
share|improve this question

marked as duplicate by slm, devnull, X Tian, Gilles, jasonwryan Mar 21 at 23:37

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

    
See if this answer helps: stackoverflow.com/questions/20649387/… –  Ketan Mar 21 at 18:19
    
The answers there all strip out the log and just show the date. I need to preserve the log entries by filtering by date. –  spuder Mar 21 at 18:23
    
    
add comment

4 Answers 4

up vote 2 down vote accepted

This should yield the desired result.

egrep "08:[23]5:[0-5][0-9]" foo

Using cat in this case is not needed.

share|improve this answer
add comment

With these inputs:

01/15 00:00:01  INFO:     received connect request from 10.10.10.10
01/14 00:00:01  INFO:     received connect request from 10.10.10.10
01/14 08:25:01  INFO:     received connect request from 10.10.10.10
01/14 00:00:01  INFO:     received connect request from 10.10.10.10
01/14 00:00:01  INFO:     received connect request from 10.10.10.10
01/14 08:35:01  INFO:     received connect request from 10.10.10.10
01/14 00:00:01  INFO:     received connect request from 10.10.10.10

You can print all lines between two pattern, using awk:

awk -v date='01/14' '$1!=date{next};/08:25/,/08:35/' logfile

01/14 08:25:01  INFO:     received connect request from 10.10.10.10
01/14 00:00:01  INFO:     received connect request from 10.10.10.10
01/14 00:00:01  INFO:     received connect request from 10.10.10.10
01/14 08:35:01  INFO:     received connect request from 10.10.10.10
share|improve this answer
add comment

You could use perl. The following performs a lexical comparison on the time field which implies that it'd work even if you don't have a line containing the starting or ending time.

 yourprogram | perl -lane 'print if $F[1] ge "08:25:00" and $F[1] lt "08:36:00"'

This assumes that the time is the second field in your input and is of the form hh:mm:ss.

You could also specify the date by adding another condition:

 yourprogram | perl -lane 'print if $F[1] ge "08:25:00" and $F[1] lt "08:36:00" and $F[0] eq "01/14"'

The input is generated using the following script:

for ((h=8;h<9;h++)); do
  for ((m=20;m<40;m=m+2)); do
    for ((s=0;s<60;s=s+10)); do
      printf "01/14 %02d:%02d:%02d line %d\n" $h $m $s $((++l))
    done
  done
done

Executing

bash script | perl -lane 'print if $F[1] ge "08:25:00" and $F[1] lt "08:36:00"'

produces:

01/14 08:26:00 line 19
01/14 08:26:10 line 20
01/14 08:26:20 line 21
01/14 08:26:30 line 22
01/14 08:26:40 line 23
01/14 08:26:50 line 24
01/14 08:28:00 line 25
01/14 08:28:10 line 26
01/14 08:28:20 line 27
01/14 08:28:30 line 28
01/14 08:28:40 line 29
01/14 08:28:50 line 30
01/14 08:30:00 line 31
01/14 08:30:10 line 32
01/14 08:30:20 line 33
01/14 08:30:30 line 34
01/14 08:30:40 line 35
01/14 08:30:50 line 36
01/14 08:32:00 line 37
01/14 08:32:10 line 38
01/14 08:32:20 line 39
01/14 08:32:30 line 40
01/14 08:32:40 line 41
01/14 08:32:50 line 42
01/14 08:34:00 line 43
01/14 08:34:10 line 44
01/14 08:34:20 line 45
01/14 08:34:30 line 46
01/14 08:34:40 line 47
01/14 08:34:50 line 48
share|improve this answer
add comment

If you are open to use sed, you can do :

sed -n '/^01\/14 08:00/,/^01\/14 08:10/p' foo

In general, you can use bash variables replace with the specific times in the above command. For example:

st="01\/14 08:00"
en="01\/14 08:25"
sed -n "/^$st/,/^$en/p" foo #note the double quotes

You need to escape the / character with a \ if using / as separator as shown in the above command.

share|improve this answer
    
Thanks, I wonder if this is a GNU sed specific syntax. I get error: 'invalid command code 1' when running on my mac (bsd sed) –  spuder Mar 21 at 18:39
    
This wouldn't really work if the log doesn't contain any entry with either 08:25 or 08:35. –  devnull Mar 21 at 18:41
    
@devnull Thanks, I made a small edit in response. –  Ketan Mar 21 at 18:43
    
@spuder I made an edit. Try again. –  Ketan Mar 21 at 18:47
    
Thanks, it looks like this is still catching some incorrect values. 01/14 00:03:39 INFO: job 11472436[14228] violates idle –  spuder Mar 21 at 18:51
show 1 more comment

Not the answer you're looking for? Browse other questions tagged or ask your own question.