I have a series of logs that I need to analyse.
each looks something like:234.10.72.175 Mon Mar 02 20:25:00 GMT 2009
226.91.87.86 Thu Mar 05 03:50:26 GMT 2009
226.91.87.86 Thu Mar 05 04:06:07 GMT 2009
Using awk, so far I have been able to count the lines in a specific file that match a patter. For example, those in Mar, 2009, between 10:00:00 and 12:00:00. But a combination of the text month and numeric year have me stumped.
an example of the lines I have been using
# between two times
awk -v "sTIME=${STARTTIME}" -v "eTIME=${ENDTIME}" '{if ($5 >= sTIME && $5 <= eTIME) print $1 }' home.hits
#day begins with S, so a weekend
awk '$2 ~ /^S/' test.hits
# doesnt match above...
awk '$2 !~ /^S/' test.hits
I am now having trouble with the date as they are in the mmm format.
I have thought about using sed to change the months format.
using an array and piping the output of awk into another to check.
change the times to epoch
I am currently not sure what the best way to do this is.
Cheers for looking
What is your ultimate goal? You are doing a report, it seems, so how do you want to group the final results? ie., group ip address by month, for workday activity?
For example:
awk ' /(Mon|Tue|Wed|Thu|Fri)/ { arr[$1 " " $3]++ }
END (for i in arr) { print i, arr } ' logfile | sort
awk '
/Apr/ && /2010/ {ok=0}
/Feb/ && /2009/ {ok=1}
ok { your awk code to format and group the data goes here }
{next} ' logfile > report
The {next} is needed if you are using an ancient version of awk.
This awk syntax is:
boolean { function }
where boolean evaluates to true or false. By default undeclared values like ok - are zero.
This turns on processing for the first occurrence on Feb && 2009. turns it off for the first occurrence of Apr 2010 - ie. just past Mar 2010