Find the difference between two epoch times that are in filename

Question

I have a bunch of Splunk buckets (directories) that contain two epoch timestamps in their names. I need to find a way to perform a find on those filenames to locate any files that whose second epoch time is between 1488344400 (March 1, 2017) and 1497499200 (June 15, 2017). The format of the filename is as follows:

db_1274129994_1273525194_0 (db_latesttime_earliesttime_idnum)

The "earliesttime" is the determining factor as the latest can extend past the dates.

Answer 1

Using bash:

for d in db_*_*_*; do
    if [[ "$d" =~ db_([0-9]*)_([0-9]*) ]]; then
        if [[ "${BASH_REMATCH[2]}" -ge 1488344400 ]] &&
           [[ "${BASH_REMATCH[2]}" -le 1497499200 ]]; then
            printf 'Found "%s"\n' "$d"
        fi
    fi
done

This iterates over all db_*_*_* names in the current directory. If any name matches the regular expression db_([0-9]*)_([0-9]*), then a numerical comparison is carried out on the last of the two found numbers in the name. If the comparison comes out true, then the name is reported on standard output.

Answer 2

ls /path/to/your/buckets | awk -F_ '$3 >= 1488344400 && $3 <= 1497499200'

Note: in the general case, one must not parse ls, but since we know that our filenames won't contain special characters, we shouldn't get into trouble in this particular case.

As for the awk: we simply define _ as the field separator and print all lines where the third field ("earliesttime" according to you) is between the epoch times you mentioned.

Answer 3

With bash:

for f in db_[0-9]*_[0-9]*; do 
    e_time="${f:14:10}"    # extracting 'earliest time'
    if [ $e_time -ge 1488344400 ] && [ $e_time -le 1497499200 ]; then 
        echo "$f"
    fi
done