I am using cygwin and have some experience writing scripts, using grep. it gave me the possibility to find some particular strings in huge logfiles. Now I am facing a next challenge, but don't know how to solve it. Basically I want to check a number in a file, with the same number in a previous line. Consider the following file:

Tracelog file

the 2nd column in this message is a relative time in milliseconds.

I want to check the differences with the previous value. I want to display the occurences, where the differences are greater than 50msec (717 - 667 > 50)

Anyone knows how to do this? The way I have used grep is filter a complete file in a hole. It is great and powerfull, but now I can't use it here.

  • 2
    You'd want to display both lines, or only the 2nd (too-large) one? – Jeff Schaller Aug 17 '17 at 10:18
  • hi Jeff, Only the 2nd is enough, and stored in a file. – Foppe Aug 17 '17 at 12:09
  • I want to check my huge logfiles, to see if serial communication has paused for a few seconds. This occurence is rare and happens only ounce in a million time. I expect to get a file with one or 2 occurences, or an empty file if everything is okay. – Foppe Aug 17 '17 at 12:15

That's a typical job for awk:

awk '$2 - prev > 50; {prev = $2}' < file

Or to only consider lines that have a number in the second field and skip the first line with a number:

awk 'prev != "" && $2 - prev > 50; $2 ~ /[0-9]/ {prev = $2}' < file
  • thanks, I will test it. Currently it prints every occurence, but will see how to fix it. – Foppe Aug 17 '17 at 12:02
  • The following works for me: awk '$2 - prev > 65.000; { prev = $2 }' < $1 – Foppe Aug 17 '17 at 12:58
  • Is it possible to remove the first occurence from line 1 (value 667)? This is not a real hit, but it will result in a hit, because the previous was a comment line – Foppe Aug 17 '17 at 13:04
  • @Foppe, you did ask for a difference greater than 50, not 65. See edit for ignoring the first line. – Stéphane Chazelas Aug 17 '17 at 13:08
  • yes but that's just fine tuning, when using 50, I get a number of occurences that differ 51 or 55 milliseconds. But actually the timing for these messages was okay. I want to filter out the occurences where there was no message sent for 150 - 250 msec. 65 works fine for me now. – Foppe Aug 17 '17 at 13:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.