Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Here's my output:


I want only the time.

How can I separate them?

share|improve this question
So output Should be 07:46.099 ? – Rahul Patil May 3 '13 at 2:08

Analyse the structure of the input:


These are fields separated by ;, which you can parse by making ; the field separator. Then, to extract the value of a field, use the sub function to remove the key= part (or split on /=/ and take the second part, or take the substring after the index of =). If the time is always in the second field, this is a simple approach:

awk -F ';' '{sub(/^[^=]*=/, $2); print $2}'

If you want to access the field by name (which is probably more robust), you can loop over the fields:

awk -F ';' '{i=1; while (i <= NF) {if ($i ~ /^EsbTiming=/) {sub(/^[^=]*=/, $i); print $i}}}'

If you only have one line to parse, it's simpler to make ; the record separator and = the field separator.

awk -F '=' -v RS=';' '$1 == "EsbTiming" {print $2}'

Note that this prints an extra newline. This isn't a concern if you're using this command in a command substitution in a shell script (… | awk …). If you don't want this extra newline, set ORS (output record separator) to the empty string:

awk -F '=' -v RS=';' -v ORS= '$1 == "EsbTiming" {print $2}'

There's also the direct regular expression approach, which here gives good results.

awk 'match($0, /(^|;)EsbTiming=/) {s = substr($0, RSTART+RLENGTH); sub(/;.*/, "", s); print s}'
share|improve this answer

You have several awk answers, here's one way you could do it with bash. First evaluate the variable setting:

source <(echo "MessageID=3990592283244651750-30192b51.13df831d93a.7eb4;EsbTiming=2013-04-12T01:07:46.099")

You can now access EsbTiming directly, e.g.:

printf "Date: %s\nTime: %s\n" ${EsbTiming%T*} ${EsbTiming#*T}


Date: 2013-04-12
Time: 01:07:46.099
share|improve this answer
awk 'BEGIN{ FS=":" } /Timing/ {print $2":"$3 }' Input_file


awk  '/Timing/{split($0,arr,":") } {print arr[2]":"arr[3]}'  input_file


awk -F: '/Timing/{$1=""; print}'  input_file

Grep Solution

grep -oP '(?<=EsbTiming=.{14}).*' Input_file
share|improve this answer
This get's rid of the colons, ":". I'm getting this " 07 46.099". – slm May 3 '13 at 2:26
@slm I have updated one more ans – Rahul Patil May 3 '13 at 2:46

Simple, split by "T"

awk -F 'T' {'print $3'} input_file
share|improve this answer

If you don't mind using awk and sed here's a pretty straightforward way to do it:

sed 's/.*Timing=//' file.txt |awk -FT '{print $2}'

sed portion collapses everything up to and including the string "Timing=" out leaving you with:


awk splits on the character "T" and we print out the 2nd field which is your time.

share|improve this answer

A grep solution:

grep -oP "(?<=EsbTiming=).*" input

-o to print only the match, not whole line

-P to use Perl regex, so we can use...

(?<=lookahead_expr) will return a match for the regex following is "positive lookbehind" -- in our case, returning the time string that follows the string 'EsbTiming='

share|improve this answer
He asked for awk based solution – Eugene S May 3 '13 at 2:58
I'm aware. He should use the right tool for the job. Granted I don't know his specific circumstances, but based on the question, grep is a simpler choice. – Nathan Wallace May 3 '13 at 12:04
-P uses Perl regular expressions. – Thor May 4 '13 at 11:54

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.