using mergecap for set of files

Question

Im trying to use mergecap to merge 15 old pcap files in a folder. I tried to use

FILES=($(find /mnt/md0/capture/DCN/ -maxdepth 1 -type f -name "*.pcap"  -print0 | xargs -0 ls -lt | tail -15 | awk '{print $8}'))

and use mergecap command as mergecap -w Merge.pcap ${FILES[@]} but the mergecap doesnt run when I put it on crontab. Is there any method to combine these two commands to work properly.

I tried as answer suggested @l0b0 tried find /mnt/md0/capture/DCN/ -maxdepth 1 -type f -name "*.pcap" -print0 | tr '\0\n' '\n\0' | tail -15 | tr '\0\n' '\n\0' | xargs -r0 mergecap -w /mnt/md0/capture/DCN/Merge_"${TAG1}".pcap in order to get the name of the oldest file to be merged into the output files name. But it gives gibberish as the file name. Am I doing anything wrong? Following scripts gets me the file names

FILES=($(find /mnt/md0/capture/DCN/ -maxdepth 1 -type f -name "*.pcap"  -print0 | xargs -0 ls -lt | tail -15 | awk '{print $8}'))

TAG1=$(basename "${FILES[0]}" | sed 's/.pcap//')

Answer 1

With zsh (again):

mergecap -w Merge.pcap /mnt/md0/capture/DCN/(D.om[-15,-1])

Or with GNU tools:

cd /mnt/md0/capture/DCN/ &&
  find . -maxdepth 1 -name '*.pcap' ! -name Merge.pcap -type f  -printf '%T@@%p\0' |
    tr '\0\n' '\n\0' |
    sort -n |
    head -n 15 |
    cut -d@ -f2- |
    tr  '\0\n' '\n\0' |
    xargs -r0 mergecap -w Merge.pcap

Answer 2

You can use a trick to use tail on NUL-delimited output:

find /mnt/md0/capture/DCN/ -maxdepth 1 -type f -name "*.pcap" -print0 |
  tr '\0\n' '\n\0' |
  tail -n 15 |
  tr '\0\n' '\n\0' |
  xargs -r0 mergecap -w Merge.pcap

And you should not parse ls output.