LinuxQuestions.org - [SOLVED] How to fetch entries in a log file for a particular period of time ?

- Linux - Enterprise (https://www.linuxquestions.org/questions/linux-enterprise-47/)

- - How to fetch entries in a log file for a particular period of time ? (https://www.linuxquestions.org/questions/linux-enterprise-47/how-to-fetch-entries-in-a-log-file-for-a-particular-period-of-time-935198/)

How to fetch entries in a log file for a particular period of time ?

Hi Team,

I would like to know with the help of shell script how can we find entries in a log file for a period of time.

Say Example : I wish to extract the log entries from 01:05:00 to 02:08:00.

Note:- My log file is a huge one and it contains approx 100 lines/sec.

Log File Look Like Below:-

<7763> <09/08/2010 00:00:03.389> (9)SMS:Read SMS size<38>[4](*********)
<7763> <09/08/2010 00:00:03.390> (9)SMS:Read SMS<38>[100](
<7763> <09/08/2010 00:00:03.390> (9)SMS:Receive Request[100](

Thanks In Advance.

A limited ability to select log entries can be done with the grep command. It won't be so simple as identify first and last times. Given the out of order timestamp format, you will need to code some complex conversion. You might use the awk language for that. What scripting languages do you know?

Hi,

Regular expressions are your friend, although you need to be careful with false hits.

You only posted a limited example and I assume that the lines are (a lot?) longer then shown.

This seems to work for the layout given:

Code:

awk '/ 01:(0[5-9]|[1-5][0-9]):[[:digit:].]+> / { print $0 } ; / 02:0[0-8]:[[:digit:].]+> / { print $0 }' infile

Example:

Code:

$ cat infile

<7763> <09/08/2010 00:00:00.390> (9)SMS:Read SMS<38>[100]( 

<7763> <09/08/2010 01:03:00.390> (9)SMS:Receive Request[100](

<7763> <09/08/2010 01:05:00.389> (9)SMS:Read SMS size<38>[4](*********)

<7763> <09/08/2010 01:30:02.389> (9)SMS:Read SMS size<38>[4](*********)

<7763> <09/08/2010 01:59:59.389> (9)SMS:Read SMS size<38>[4](*********)

<7763> <09/08/2010 02:00:00.390> (9)SMS:Read SMS<38>[100]( 

<7763> <09/08/2010 02:08:00.390> (9)SMS:Receive Request[100](

<7763> <09/08/2010 02:08:59.390> (9)SMS:Receive Request[100](

<7763> <09/08/2010 02:09:00.389> (9)SMS:Read SMS size<38>[4](*********)

<7763> <09/08/2010 10:00:00.390> (9)SMS:Read SMS<38>[100]( 

<7763> <09/08/2010 23:00:00.390> (9)SMS:Receive Request[100](



$ awk '/ 01:(0[5-9]|[1-5][0-9]):[[:digit:].]+> / { print $0 } ; / 02:0[0-8]:[[:digit:].]+> / { print $0 }' infile

<7763> <09/08/2010 01:05:00.389> (9)SMS:Read SMS size<38>[4](*********)

<7763> <09/08/2010 01:30:02.389> (9)SMS:Read SMS size<38>[4](*********)

<7763> <09/08/2010 01:59:59.389> (9)SMS:Read SMS size<38>[4](*********)

<7763> <09/08/2010 02:00:00.390> (9)SMS:Read SMS<38>[100]( 

<7763> <09/08/2010 02:08:00.390> (9)SMS:Receive Request[100](

<7763> <09/08/2010 02:08:59.390> (9)SMS:Receive Request[100](

Hope this helps.

Hi Druuna,

I liked that combination and it really worked for me after doing certain changes.

Thanks a lot for the same.

Thank you Skaperan for looking into the same & for the quick response.