cut only date and time (i.e.05-09-2018-10.13) from below string

09-2018-10.13:ADMU4000I: Server Node_axpin-zhgahh_AppClusterMember stop 
09-2018-23.00:ADMU4000I: Server Node_axpin-zhgahh_AppClusterMember stop 

I tried below combination but it returns me


zgrep -i "AppClusterMember stop completed" /pi_nfs/pixin/axpin 
zhgahh/was_logs/was_admin_logs/start_WPS.log.05-09-2018*|cut -d '.' -f3


05-09-2018-10.13:ADMU4000I: Server Node_axpin-zhgahh_AppClusterMember 
stop completed
05-09-2018-23.00:ADMU4000I: Server Node_axpin-zhgahh_AppClusterMember 
stop completed

Expected Output:


closed as unclear what you're asking by Scott, Anthony G - justice for Monica, Jeff Schaller, LinuxSecurityFreak, Archemar May 14 '18 at 14:17

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • Is 09 part of the date in the same line or the next one? – Iskustvo May 10 '18 at 22:00
  • yea its part of same line ..date 05-09-2018 – khuharshree May 10 '18 at 23:02
  • Oh, ok, I posted my solution. However, you should edit the question because at the moment, it looks like there is new line after 05- in your file sample. – Iskustvo May 10 '18 at 23:07
  • 1
    I have updated my answer for that request as well. I know this is your first question here, but PLEASE NOTE that you should never change requests like this. 1) If I only had answer to your last question in my official answer, someone might down vote it because it doesn't answer your original question. 2) If you edit the question and just change requests, then answers up until now might get down voted because they don't answer your specific needs. – Iskustvo May 10 '18 at 23:48
  • 1
    For the reasons stated above, please edit the question including following: 1) Change the file sample to represent the real state ( remove the spaces and new lines where they don't belong) 2) Add the additional request about the zgrep at the end of the qeustion under the H1 header named EDIT. For the future, stick to the original question or create a new one. – Iskustvo May 10 '18 at 23:56


grep -Eo "[0-9]{2}-[0-9]{2}-[0-9]{1,4}-[0-9]{2}\.[0-9]{2}" file



-E - Use extended regex. (Allow some characters in regex to be used without escaping them.)

-o - Print only the matched output.


[0-9] - Match a character if it is a digit from 0-9.

[0-9]{x} - Match x sequential characters if they are a digit 0-9.

[0-9]{x,y} - Match at least x sequential characters if they are a digit 0-9 but if there are more, match up to y of them.

- Has no special meaning, grep will try to match the exact character -.

. Means any character so it has to be escaped with \ to mean exact character ..

Answer for additional request in the question comments

zgrep -Po "[0-9]{2}-[0-9]{2}-[0-9]{1,4}-[0-9]{2}\.[0-9]{2}(?=.*stop completed\.)" file.gz


From zgrep manual:

Zgrep invokes grep on compressed or gzipped files.
All options specified are passed directly to grep.

Therefore, I will explain only newly added flag and regex parts.


-P - Use Perl regex. (Allows look-ahead)


(?=.*stop completed\.) - Regex part from (?= to ) is called Positive look-ahead.
In this case it matches the previous regex only if the line contains stop completed. afterwards.

  • Explanation for -1 would be great. – Iskustvo May 11 '18 at 1:42
  • I didn’t downvote, but (1) Do you really believe that 05-09-7-10.13 should be matched? (2) Try to avoid presenting the same information twice. – Scott May 11 '18 at 3:38
  • @Scott First of all, thank you for the edit. As for questions: 1) Probably not, but I wanted to give an option. I think that I have explained decent enough so that anyone can change that and use it however they like. 2) You are right, I'll edit to remove already explained parts. – Iskustvo May 11 '18 at 8:07
echo "/pi_nfs/pixin/axpin-zhgahh/was_logs/was_admin_logs/start_WPS.log.05-09-2018-10.13:ADMU4000I: Server Node_axpin-zhgahh_AppClusterMember stop completed." | cut -d"." -f3,4 | cut -d":" -f1

output is


So I guess you need something like the following

cut -d"." -f3,4 YOUR_FILENAME | cut -d":" -f1

Where YOUR_FILENAME is the actual filename you want to use

awk -F: '{split($1,a,".");print a[3]"."a[4]}' input.txt

zgrep -i "AppClusterMember stop completed" /pi_nfs/pixin/axpin zhgahh/was_logs/was_admin_logs/start_WPS.log.05-09-2018* | awk -F: '{split($1,a,".");print a[3]"."a[4]}'
  • -F: splits the records by : (colon)
  • split($1,a,".") - Split the record 1 by . (dot) and keep the values in array called a
  • print a[3]"."a[4] - print the array values.
  • 1
    Can you please add few words which will explain the commands? – Romeo Ninov May 11 '18 at 9:12
  • Thanks a lot Kamaraj . Above solution works as expected and also appreciate explaining it in detail. – khuharshree May 11 '18 at 13:26

Not the answer you're looking for? Browse other questions tagged or ask your own question.