Time/Date grep for 15 mins

Question

I need to grep a specific type of line in a specific time of the log, do you have any ideas?

Here's my working script:

cat *.log |grep -E '2011-06-30 (1[0-1]:[0-1][0-5]|10:16)'| grep -ach '0110 478655 ..  51' * | awk '{SUM += $1} END { print SUM }'

The above line is working for 00:00-00:16 time. I need to sum all the grep results for that specific time. How do I grep the string:

00:15-00:31, 00:30-00:46, 00:45-01:01

Note that the time should be variable as well, meaning it wont be always 00:00-01:01 - is there a way I can do this?

Answer 1

You can match times with a regular expression, but it's not the best tool for the job. Put all the logic into awk and perform numeric comparisons.

Awk doesn't have specific facilities for manipulating dates. GNU awk offers mktime and strftime as an extension. For the problem as specified, you don't need these extensions, but they might come in handy if your requirements grow more complex.

The “working” script you give is probably not what you meant to write: your second grep call has file names as arguments (*), so it won't read from its standard input. And you don't show sample input either. So I don't know what your requirements are.

Here's some example code that assumes that all log lines begin with a date, and that you want to sum the numbers that appear at the end of the matching lines in all log files. Pass the date in the year, month and day variables and the starting time in hour and minute; the snippet looks for log entries in a 15-minute range that isn't allowed to span to a different day.

awk -vyear=2011 -vmonth=6 -vday=30 -vhour=0 -vminute=15 -vRS='[-: ]+' '
BEGIN {start = hour * 60 + min; stop = start + 15}
{time = $4 * 60 + $5}
$1==day && $2== month && $3==day && start <= time && time <= stop && $NF ~ /^[0-9]+$/ {
    sum += $NF
}
END {print sum}'