LinuxQuestions.org

LinuxQuestions.org (/questions/)
-   Linux - General (http://www.linuxquestions.org/questions/linux-general-1/)
-   -   log file grep by date and year (http://www.linuxquestions.org/questions/linux-general-1/log-file-grep-by-date-and-year-4175444746/)

JJJCR 01-08-2013 07:23 PM

log file grep by date and year
 
hi guys, how do i use grep on a log file to filter by date and year.
Thanks for any input.

kbp 01-08-2013 08:50 PM

You need to know the entry and date format in use then write your regex accordingly, grep supports multiple pattern arguments so you'd do something like:

Code:

grep -e <year_regex> -e <day_of_month_regex> /path/to/logfile
Any output will have matched both patterns.

JJJCR 01-08-2013 09:50 PM

Quote:

Originally Posted by kbp (Post 4865827)
You need to know the entry and date format in use then write your regex accordingly, grep supports multiple pattern arguments so you'd do something like:

Code:

grep -e <year_regex> -e <day_of_month_regex> /path/to/logfile
Any output will have matched both patterns.

Thanks kbp, I will work on the regex and post the result here..


if i am on the directory where the log file is located, do I need to specify the path or just the name of the file?

kbp 01-08-2013 10:04 PM

Whichever you prefer .. normally I would keep scripts in a central location say /usr/local/bin, then use the absolute path.

syg00 01-09-2013 03:38 AM

You may find this post unSpawn illuminating.
Date formats vary, but the lesson is there.

JJJCR 01-14-2013 03:49 AM

hi guys, I had tried the regex but it just doesn't seem to work.

actually i'm trying to find an exact match for the date 14 Jan 2013, using the commands below:

grep '^[14]/Jan/[2013]'+/ path to log

grep '^\(14\)?\(Jan\)?\(2013\)' path to log

grep '^[14]?[Jan]?[2013]*' path to log

log file has this format:

[14/Jan/2013 16:38:51] IP address 1.2.3.4

How to do it in regex to find the exact date match?

Thanks.

kbp 01-14-2013 03:54 AM

Code:

grep -e '^\[14\/Jan\/2013.*' /path/to/log

JJJCR 01-14-2013 04:16 AM

Quote:

Originally Posted by kbp (Post 4869528)
Code:

grep -e '^\[14\/Jan\/2013.*' /path/to/log

Wow..thank you... it works 100%

sorry the dot after 2013 followed by * what does it mean?

2013. <--this dot what it means?

linosaurusroot 01-14-2013 05:19 AM

The final .* of the regex is pointless - dot means any character and * means zero or more repetitions of dot. You can end this RE at 2013

kbp 01-14-2013 05:32 PM

True .. I think I put it in due to habit, commonly matching different pieces of a line

JJJCR 01-14-2013 09:24 PM

hi guys, thank you so much for all your help!


All times are GMT -5. The time now is 07:46 AM.