0

enter image description here I have a log file like this; I can get NOW=HOUR=date +'%H'

I can get login time in hour with something like cat file | awk '{print $2}' | cut -d: -f1

Is there a way I can compare the login times in hours in the file against current time in hour and say if the login hour is > 5 hours and display the record only matching that criteria.

Say its 3pm which is 15 hours, we would not like to display below as log in times are less than 5 hours

11:26:16 Login.Success yden8703 gkU3Qx4iiWPVMrV

12:26:24 Login.Success pxia9495 2OVvMrAmgRAOZyJ

closed as unclear what you're asking by Michael Homer, G-Man, cuonglm, Anthon, dhag May 25 '15 at 6:40

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 2
    It's not clear what exactly you want. - How to handle entries from previous days? Is there a lower limit or also an upper limit to filter? Is the current time (hour) related to the actual value(s) of the limit(s)? Do you need accuracy of only full hours? - For one simple interpretation see below in the answer. – Janis May 25 '15 at 2:10
  • 1
    notepad - how quaint! :) - real text (embedded as code) is better. as we can copy and paste it for testing. – Peter.O May 25 '15 at 4:56
1
 awk -v argsec=$((5*60*60)) '
        BEGIN{ nowsec=systime() }
      { logsec=mktime(gensub(/[-:]/," ","g",$1" "$2));
        if(nowsec-logsec<=argsec) print;
      }' logfile

Your could put the conversion of 5 hours to seconds in awk's BEGIN block, but it seems more flexitple to have it in an arg variable.

0

To get the login lines from a logfile that have an hour greater than 05:00:00 in column 2 try:

awk '$2+0>=5' logfile

Not the answer you're looking for? Browse other questions tagged or ask your own question.