从 Shell 脚本 (.ksh) 中的日志文件中筛选与给定时间比较的最近 2 条日志答案

【问题标题】：Filter a most recent 2 logs in comparison with a given time from a log file in Shell scripting (.ksh)从 Shell 脚本 (.ksh) 中的日志文件中筛选与给定时间比较的最近 2 条日志
【发布时间】：2013-11-11 01:08:48
【问题描述】：

我正在分析一个套接字服务器的大型日志文件以跟踪一些事件。我在使用 shell 脚本获取给定时间（一个在给定时间之前，另一个在给定时间之后）的最近 2 条消息日志时遇到问题。在这种情况下，我只能使用日志文件的日期时间值

 e.g. triggering time: 2013-10-31 07:29:45.311
    think I have an event from another log at 2013-10-31 07:29:45.311 and need to filter 
the most recent message log one is before above time and other one is after from below sample log. 

    given time = 2013-10-31 07:29:45.311
    then triggered times for most recent log messages should be 
    1) before the given time: message at 2013-10-31 07:29:34.415
    2) after the given time: message at 2013-10-31 07:30:34.473

这可以使用 shell 脚本吗？

Sample log:

    2013-10-31 07:23:33.931 INFO  - TTT153|Receive|0000131|....
    2013-10-31 07:24:35.273 INFO  - TTT153|Receive|0000131|....
    2013-10-31 07:25:33.973 INFO  - TTT153|Receive|0000131|....
    2013-10-31 07:26:34.111 INFO  - TTT153|Receive|0000131|....
    2013-10-31 07:27:34.151 INFO  - TTT153|Receive|0000131|....
    2013-10-31 07:28:34.273 INFO  - TTT153|Receive|0000131|....
    2013-10-31 07:29:34.415 INFO  - TTT153|Receive|0000131|....
    2013-10-31 07:30:34.473 INFO  - TTT153|Receive|0000131|....
    2013-10-31 07:31:34.595 INFO  - TTT153|Receive|0000131|....
    2013-10-31 07:32:34.616 INFO  - TTT153|Receive|0000131|....
    2013-10-31 07:33:35.673 INFO  - TTT153|Receive|0000131|....

【问题讨论】：

有人否决了这个问题，请解释原因。

标签： shell unix grep ksh unix-timestamp

【解决方案1】：

这有点复杂，但可以通过将日期转换为纪元时间来完成。

value="2013-10-31 07:29:45.311"
awk '
    {
    split($1,a,"-")
    split($2,b,"[:.]")
    t1=mktime(a[1] " " a[2] " " a[3] " " b[1] " " b[2] " " b[3]) "." b[4]
    split(v,c,"[- :.]")
    t2=mktime(c[1] " " c[2] " " c[3] " " c[4] " " c[5] " " c[6]) "." c[7]   
    }
    t1>t2 {print  l "\n" $0;exit}
    {l=$0}
    ' v="$value" logfile

2013-10-31 07:29:34.415 INFO - TTT153|Receive|0000131|....
2013-10-31 07:30:34.473 INFO - TTT153|Receive|0000131|....

将其保存到变量中

res=$(awk '
    {
    split($1,a,"-")
    split($2,b,"[:.]")
    t1=mktime(a[1] " " a[2] " " a[3] " " b[1] " " b[2] " " b[3]) "." b[4]
    split(v,c,"[- :.]")
    t2=mktime(c[1] " " c[2] " " c[3] " " c[4] " " c[5] " " c[6]) "." c[7]   
    }
    t1>t2 {print  l "\n" $0;exit}
    {l=$0}
    ' v="$value" logfile)

echo "$res"
2013-10-31 07:29:34.415 INFO - TTT153|Receive|0000131|....
2013-10-31 07:30:34.473 INFO - TTT153|Receive|0000131|....

【讨论】：

我以前没有使用过'awk'，我无法在我的脚本中形成这个脚本部分。是不是就这样跟awk '{above entire code lines}' v="$value" file 这里一样，“file”应该代表传递的日志文件名。我说的对吗？
是的 file 是 logfile 我已经更新了帖子以显示如何将其存储到变量中。
这是因为 #!/bin/ksh 吗？（awk: Function mktime is not defined 的原因。）
我认为我的系统不支持 mktime()（我在 HP-Nonstop 服务器上工作，无法安装程序，是否有其他选项可供使用）
如果你有date命令，你可以用它来转换纪元时间，然后比较值。