Tried other solution but not giving correct solutions my time format is [Thu Aug 20 09:28:51 2020]. Most close one was this one
awk -vDate=`date -d'now-2 hours' +[%a %b %d %H:%M:%S %Y]` '$4 > Date {print Date, $0}' $input
my log file are like this
[Thu Aug 20 09:10:51 2020] [error] vendor
[Thu Aug 20 09:23:51 2020] [error] vendor
[Thu Aug 20 09:25:51 2020] [error] vendor
[Thu Aug 20 09:27:51 2020] [error] vendor
[Thu Aug 20 09:28:51 2020] [error] dad
i want result as from current time [Thu Aug 20 09:28:51 2020] to last 10 mins
[Thu Aug 20 09:23:51 2020] [error] vendor
[Thu Aug 20 09:25:51 2020] [error] vendor
[Thu Aug 20 09:27:51 2020] [error] vendor
[Thu Aug 20 09:28:51 2020] [error] dad
well i tried doing directly with grep but i dont know why but the grep wasnt taking this date format and give some wrong output so i did some way around for it .
#!/bin/bash
input="/home/babin/Desktop/code2"
count=0
dateyear=$(date +'%Y')
month=$(date +'%b')
day=$(date +'%a')
#do loop for 10 mins from now
for (( i = 0; i <=9; i++ )) ; do
if grep $(date +%R -d "-$i min") $input | grep -i "error" | grep -wi "$month" | grep -wi "$year" | grep -wi "$day"
then
currentcount=$(grep $(date +%R -d "-$i min") $input | grep -wi "70007" | grep -wi "$month" | grep -wi "$year" | grep -wic "$day")
else
currentcount=0
echo "not found"
fi
count=$(( $count + $currentcount ))
done
echo "$count"
#check no of error found and do task
if(( $count >= 10))
then
echo "more oe equal to 10 finds"
else
echo "less than 10 occurence"
fi
it gives output as currenttime is [Thu Aug 20 09:28:51 2020] also it matches "error" string.
enter [Thu Aug 20 09:23:51 2020] [error] vendor
[Thu Aug 20 09:25:51 2020] [error] vendor
[Thu Aug 20 09:27:51 2020] [error] vendor
[Thu Aug 20 09:28:51 2020] [error] dadcode here
The overall flow is:
Preprocess input to exctract the date part
Convert date to seconds since epoch
Filter seconds since epoch according to the conditions given
Remove seconds since epoch.
Output.
As a overall rule, work in bash using streams. The strptime is from dateutils package. Like so:
# Extract the date+time part from within [..] and put it on the first column with tab
sed 's/ \[\([^]]*\)\]/\1\t&/' "$input" |
# For each line
while IFS=$'\t' read -r date rest; do
# Convert the date to seconds since epoch
date=$(strptime -f "%s" -i "%a %b %d %H:%M:%S %Y" "$date")
# Output the updated line
printf "%s\t%s\n" "$date" "$rest"
done |
# Read it all in awk and compare second since epoch in the first field to given value
awk -v "since=$(date -d'now -2 hours' +%s)" '$1 > since' |
# Remove first field - ie. second since epoch
cut -f2-
Do not use backticks ``. They are discouraged. Use $(...) instead. Remember as a rule of a thumb to quote all variable expansions. Check your scripts for most common mistakes with http://shellcheck.net . I think somewhere between date and strptime you may encounter problems with your timezone (ie difference in the number of hours).
In GNU with the command date I can do it:
date -d "+4 day"
datei=20130101
i=5
date -d "$datei +$i day"
But i like know:
how can i do it in Solaris?
with the date command
Tcl has a good free-form date scanner, if you have Tcl installed (try which tclsh). A shell function:
tcldate() {
d=${1:-now} # the date string
f=${2:-%c} # the output format
echo "puts [clock format [clock scan {$d}] -format {$f}]" | tclsh
}
In action on an ancient Solaris 8 box with bash 2.03 and tcl 8.3.3
$ tcldate
Tue Jul 23 13:27:17 2013
$ i=4
$ tcldate "$i days"
Sat Jul 27 13:27:34 2013
$ tcldate "$i days" "%Y-%m-%d"
2013-07-27
$ tcldate "20130101 + $i days" "%Y-%m-%d"
2013-01-05
This even handles daylight savings transitions:
$ tcldate "2014-03-09 00:30 + 1 hour" "%D %T %Z"
03/09/14 01:30:00 EST
$ tcldate "2014-03-09 00:30 + 2 hour" "%D %T %Z"
03/09/14 03:30:00 EDT
$ tcldate "2013-11-03 00:30 + 1 hour" "%D %T %Z"
11/03/13 01:30:00 EDT
$ tcldate "2013-11-03 00:30 + 2 hour" "%D %T %Z"
11/03/13 01:30:00 EST
Looking for a bash line to take a RSS date format such as "Fri, 13 Sep 2013 17:16:45 GMT" and convert it into milliseconds?
I've tried things as below they they do not produce in milliseconds. I'm running Mac OS X Snow Leopard 10.6.8.
524 date +%s -d "Fri, 13 Sep 2013 17:16:45 GMT"
525 date +%s -d "Fri 13 Sep 2013 17:16:45 GMT"
526 date +%s -d "Fri 13 Sep 2013 17:16:45"
527 date +%s -f "Fri, 13 Sep 2013 17:16:45 GMT"
528 date +%s -f "Fri, 13 Sep 2013 17:16:45 GMT"
514 date +%s -d "Fri, 13 Sep 2013 17:16:45 GMT"
515 date +%s -d "Fri, 13 Sep 2013 17:16:45"
516 date +%s -ud "Fri, 13 Sep 2013 17:16:45 GMT"
517 date +%s -ud "Fri, 13 Sep 2013 17:16:45"
512 date -d "Fri, 13 Sep 2013 17:16:45 GMT" "+%s"
Does the RSS date have fractional seconds?
If not, using BSD date (i.e. Mac OS X):
echo $(date -j -f "%a, %d %b %Y %H:%M:%S" "Fri, 13 Sep 2013 17:16:45" +%s)000
or, according to the Mac OS X manpage:
echo $(date -j -f "%a, %d %b %Y %H:%M:%S %Z" "Fri, 13 Sep 2013 17:16:45 GMT" +%s)000
If you have GNU date, the following rather simpler expression will work:
echo $(date +%s -d "Fri, 13 Sep 2013 17:16:45 GMT")000
Or you could use this, which will work with fractional seconds in the original time string:
echo $(($(date +%s%N -d "Fri, 13 Sep 2013 17:16:45.126 GMT")/1000000))
The date command gives you time in [s] resolution. Just append 3 zeroes, if that resolution is OK for you.
date +%s -d "Fri, 13 Sep 2013 17:16:45 GMT" | sed 's/..*/&000/'
If it's not, I'm afraid you'll have to write a C program, using the system call gettimeofday(). Let's call it gettimeofday.c:
#include <sys/time.h>
#include <stdio.h>
int main(void)
{
struct timeval t;
gettimeofday(&t, NULL);
printf("%d%d\n", t.tv_sec, t.tv_usec / 1000);
return 0;
}
To compile it you need gcc and make:
make gettimeofday
And then:
./gettimeofday
On second thoughts, my little program is totally useless, since you want to convert a given date to Unix time. But I'll leave it here, because it's so nice. :-)
You can use awk to add three zeros at the end of the output to make it in ms.
date +%s -d "Fri, 13 Sep 2013 17:16:45 GMT" | awk '{print $0"000"}'
or use sed to do the same :
date +%s -d "Fri, 13 Sep 2013 17:16:45 GMT" | sed -e "s|.*|&000|g"
The above don't work in Mac OS X Lion. You have to install GNU date which is in the coreutil package in MacPorts. You will then get gdate.
Instead you can use python to do this :
python -c'import time; print "%f" % (time.mktime(time.gmtime())*1000.)'
If you get an date: illegal time format error message on Mac OS X try using LANG=C date:
- echo $(date -j -f "%a, %d %b %Y %H:%M:%S %Z" "Fri, 13 Sep 2013 17:16:45 GMT" +%s)000 # date: illegal time format
+ echo $(LANG=C date -j -f "%a, %d %b %Y %H:%M:%S %Z" "Fri, 13 Sep 2013 17:16:45 GMT" +%s)000
i have search for a solution to my shell date subtraction issue with no joy so here goes.
i have a date format like so %m%d%H%M%S which is "0102231203" and the second %Y%m%d%H%M%S, i can take the year off the second one and do a normal subtraction but when it is over a day it becomes an issue with the time being incorrect.
here is what i have tried so far
BTT=0102234500
TPP=0102233635 (after removing the year)
BT=date -d ${BTT}
TP=date -d ${TPP}
and
BT=date -d $BTT +%m%d%H%M%S
TP=date +%m%d%H%M%S -d ${TPP}
date: invalid date `0102234500'
date: invalid date `0102233635'
BT=date -d #${BTT} +%m%d%H%M%S
TP=date +%m%d%H%M%S -d #${TPP}
weird output
0329071355
0329072820
BT=date -d #${BTT}
TP=date -d #${TPP}
Thu Mar 29 07:13:55 BST 1973
Thu Mar 29 07:28:20 BST 1973
even changed it to add the year to both still
BTT=20130102234500
TPP=20130102233635
BT=date -d #${BTT}
TP=date -d #${TPP}
Fri Jul 19 08:53:55 GMT 639867
Fri Jul 19 09:08:20 GMT 639867
how do i resolve this issue.
tnx
The -d option of date accept human readable string so if you can have full length date you can do :
me#server:/tmp$ BTT=`date +"%Y-%m-%d %H:%M:%S"`
me#server:/tmp$ TPP=`date +"%Y-%m-%d %H:%M:%S"`
me#server:/tmp$ echo $((`date -d "$TPP" +%s`-`date -d "$BTT" +%s`))
3
With your datas :
me#server:/tmp$ BTT="2013-01-02 23:45:00"
me#server:/tmp$ TPP="2013-01-02 23:36:35"
me#server:/tmp$ echo $((`date -d "$BTT" +%s`-`date -d "$TPP" +%s`))
505
With the results in seconds.
How to get epoch time in shell script (for ksh)?
I am interested in getting epoch time for the start of day (so e.g. now is July 28th, 2011 ~ 14:25:00 EST, I need time at midnight).
If you have GNU date,
epoch=$( date -d 00:00 +%s )
Otherwise, if you have tclsh,
epoch=$( echo 'puts [clock scan 00:00]' | tclsh )
Otherwise,
epoch=$( perl -MTime::Local -le 'print timelocal(0,0,0,(localtime)[3..8])' )
ksh's printf '%(fmt)T' supports time calculating. For example:
$ printf '%T\n' now
Mon Mar 18 15:11:46 CST 2013
$ printf '%T\n' '2 days ago'
Sat Mar 16 15:11:55 CST 2013
$ printf '%T\n' 'midnight today'
Mon Mar 18 00:00:00 CST 2013
$