LinuxQuestions.org
View the Most Wanted LQ Wiki articles.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - General
User Name
Password
Linux - General This Linux forum is for general Linux questions and discussion.
If it is Linux Related and doesn't seem to fit in any other forum then this is the place.

Notices

Reply
 
Search this Thread
Old 09-06-2011, 12:49 AM   #1
devUnix
Member
 
Registered: Oct 2010
Location: Bengaluru, India
Distribution: RHEL 5.1 on My PC, & SunOS / Sun Solaris, RHEL, SuSe, Debian, FreeBSD and other Linux flavors @ Work
Posts: 553

Rep: Reputation: 46
Combining regex in grep


I have logs that look like as follows:

Some IP ... Some Text ... [Sep/03/2011:15:55:30 -Some Number]... Some Text... End of Line
Some IP ... Some Text ... [Sep/03/2011:18:45:27 -Some Number]... Some Text... End of Line
Some IP ... Some Text ... [Sep/03/2011:21:46:00 -Some Number]... Some Text... End of Line

I want to "grep" lines for the hours between 16:00:00 and 22:00:00 only.

So these two lines of "grep" work fine for me:

Code:
grep -hE ':1[6789]:[0-9][0-9]:[0-9][0-9]:*' data.log
grep -hE ':2[01]:[0-9][0-9]:[0-9][0-9]:*' data.log
But I want to combine the "regex" I have used in the above lines because I, in fact, want a count of the matches. So "-c" will give me the count but since I have used two "grep" commands so I get two counts. Well, I do not wish to sum the counts as it is redundant.

I have tried these methods:


Code:
grep -hE ':1[6789]:[0-9][0-9]:[0-9][0-9]:* \| :2[01]:[0-9][0-9]:[0-9][0-9]:*' data.log
but it gives results for the first part of the regex only and


Code:
grep -hE ':1[6789]\|2[01]:[0-9][0-9]:[0-9][0-9]:*' data.log
gives me results for "1[6789]" only and the regex matches values in Minutes and Seconds as well.

So, is there any way to say:

I want to "grep" piece of data from lines containing hours values preceded by a : and followed by a : and found in the form of HH:MM:SS (24 hours clock) and the time I am interested in is between 16 and 22 only irrespective of any Minutes and Seconds in between.
 
Old 09-06-2011, 03:53 AM   #2
druuna
LQ Veteran
 
Registered: Sep 2003
Posts: 10,532
Blog Entries: 7

Rep: Reputation: 2374Reputation: 2374Reputation: 2374Reputation: 2374Reputation: 2374Reputation: 2374Reputation: 2374Reputation: 2374Reputation: 2374Reputation: 2374Reputation: 2374
Hi,
Quote:
Originally Posted by devUnix View Post
Code:
grep -hE ':1[6789]:[0-9][0-9]:[0-9][0-9]:* \| :2[01]:[0-9][0-9]:[0-9][0-9]:*' data.log
If I understand the problem correctly, you where almost there with the above command.

Try this:
Code:
grep -hE '(:1[6789]:[0-9][0-9]:[0-9][0-9]:*|:2[01]:[0-9][0-9]:[0-9][0-9]:*)' data.log
If you want to use multiple patterns when using grep (egrep or grep -E) you need to put the between ( and ) seperated by a | (not escaped). These will grep foo or bar:
Code:
egrep "(foo|bar)" file
grep -E "(foo|bar)" file
Hope this helps.
 
1 members found this post helpful.
Old 09-06-2011, 11:11 AM   #3
devUnix
Member
 
Registered: Oct 2010
Location: Bengaluru, India
Distribution: RHEL 5.1 on My PC, & SunOS / Sun Solaris, RHEL, SuSe, Debian, FreeBSD and other Linux flavors @ Work
Posts: 553

Original Poster
Rep: Reputation: 46
Quote:
Originally Posted by druuna View Post
Hi,
If I understand the problem correctly, you where almost there with the above command.

Try this:
Code:
grep -hE '(:1[6789]:[0-9][0-9]:[0-9][0-9]:*|:2[01]:[0-9][0-9]:[0-9][0-9]:*)' data.log
If you want to use multiple patterns when using grep (egrep or grep -E) you need to put the between ( and ) seperated by a | (not escaped). These will grep foo or bar:
Code:
egrep "(foo|bar)" file
grep -E "(foo|bar)" file
Hope this helps.

Thanks Druuna!

I had tried parentheses (|) before also but not sure what I missed out that caused an error on the production box. Only now I found that I had not quoted the pattern:

Code:
[demo@localhost Bash]$ grep -E :(1[6789]|2[12]):[0-9][0-9]:[0-9][0-9].* sample.log 
bash: syntax error near unexpected token `('
[demo@localhost Bash]$
It works fine:

Code:
[demo@localhost Bash]$ cat sample.log 
127.0.0.1 [Sep/02/2011:01:19:21 -123456] --- Blah! Blah!
127.0.0.1 [Sep/02/2011:14:21:23 -123456] --- Blah! Blah!
127.0.0.1 [Sep/02/2011:16:35:11 -445566] --- oh! Ha! Ho!
127.0.0.1 [Sep/02/2011:19:35:11 -445566] --- oh! Ha! Ho!
127.0.0.1 [Sep/02/2011:20:00:00 -445566] --- oh! Ha! Ho!
127.0.0.1 [Sep/02/2011:21:12:05 -434445] --- ooops! Oi!
127.0.0.1 [Sep/02/2011:21:22:05 -434445] --- ooops! Oi!
127.0.0.1 [Sep/02/2011:25:16:22 -234244] ..... Eureka!
127.0.0.1 [Sep/02/2011:25:45:22 -234244] ..... Eureka!
[demo@localhost Bash]$ grep -E ':(1[6789]|2[01]):[0-9][0-9]:[0-9][0-9].*' sample.log 
127.0.0.1 [Sep/02/2011:16:35:11 -445566] --- oh! Ha! Ho!
127.0.0.1 [Sep/02/2011:19:35:11 -445566] --- oh! Ha! Ho!
127.0.0.1 [Sep/02/2011:20:00:00 -445566] --- oh! Ha! Ho!
127.0.0.1 [Sep/02/2011:21:12:05 -434445] --- ooops! Oi!
127.0.0.1 [Sep/02/2011:21:22:05 -434445] --- ooops! Oi!
[demo@localhost Bash]$
So, I have tried this pattern which is short for what you and I have discussed above:

Code:
':(1[6789]|2[01]):[0-9][0-9]:[0-9][0-9].*'

Last edited by devUnix; 09-06-2011 at 11:13 AM.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
perl grep not finding regex WindozBytes Programming 6 05-29-2008 01:21 PM
grep regex . matches new lines?! lambchops468 Linux - Newbie 3 03-24-2008 09:19 PM
regex in ls vs. grep jhwilliams Linux - Software 2 08-10-2007 10:14 PM
combining grep and editor at the prompt FraserR Linux - Newbie 5 08-19-2004 09:58 PM
grep (possibly regex) question. mwtheobald Linux - Newbie 1 08-17-2002 03:05 PM


All times are GMT -5. The time now is 05:26 PM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration