CODEWITHSUNDEEP
awk
monk
monk

Reputation: 2115

find the difference in substring of timestamp in awk

I am trying to append some text in /var/log/messages output whenever the timestamp between the two consecutive log is different such as :

previous log: 00:01:59 and current log 00:02:00
or
previous log:00:01:49 and current log 00:01:50

above substring of timestamp if different in consecutive log, append some message to $0.

You may run below command it is working for 1 minute, needed it for 10 sec. 

tail -f /var/log/messages |awk '{split($3,a,":");split($3,b,"");new_time=a[1]":"a[2]":"b[1]; if(prev_time==new_time) print $0; else print "10 Second group is over, starting new: "$0" "prev_time " "new_time }   {split($3,a,":");split($3,b,"");prev_time=a[1]":"a[2]":"b[1]}'

Required result is modification of above command to print same message in 10 second gap of logs , currently its doing for 1 minute. I have used split() to capture 'HH:MM:S" not "HH:MM:SS",so whenever privious 'HH:MM:S" and current 'HH:MM:S"differ , print the message "10 Second group is over, starting new: $0". Not sure what is the mistake here. In short, currently its working when a minute changes, I need it when second changes from 39 to 40th sec or 09 sec to 10 sec. NOT 11 sec to 12 sec. HH:MM:SS , S marked in bold needed to be changed.

Sample lines:

Jan 23 15:09:54 foo bar
Jan 23 15:10:04 bla bla

Upvotes: 0

Views: 60

Answers (1)

karakfa
karakfa

Reputation: 67507

this is the general idea:

$ for((i=35;i<45;i++)); do echo Jan 23 00:01:$i; done |  
  awk '{split($3,a,":"); print $0, (p!=(c=int(a[3]/10))?"<<<":""); p=c}'

Jan 23 00:01:35 <<<
Jan 23 00:01:36 
Jan 23 00:01:37 
Jan 23 00:01:38 
Jan 23 00:01:39 
Jan 23 00:01:40 <<<
Jan 23 00:01:41 
Jan 23 00:01:42 
Jan 23 00:01:43 
Jan 23 00:01:44

first part is the test data generated for the script since you didn't provide enough. There is spurious first line match, which can be eliminated with NR>1 condition but I don't think that's critical.

Upvotes: 1

Related Questions