Bash Script Closest Timestamp (LOG FILE)

Shell Programming and Scripting
1

Hi All,
I need something where I could take the date from FILE1 and in this case the date is Thu Sep 10 13:48:42 EDT 2015 and I need it to match the closest PREVIOUS date in the log file FILE2 this means in this specific case it would be Thu Sep 10 2015 13:35:28 .

I only need the closest date and nothing else as I am grepping and sedding with the value gotten, btw the date can be days before in some rare cases.

FILE1

77777;HP-BLADE;4;661;0;1;Thu Sep 10 2015 13:48:42;0;0;Matthew;send email to Carlos;

FILE2

Thu Sep 10 2015 03:01:18;.1.3.6.1.4.1.x.x.3.34;Critical;Status Events;87.200.x.x;77777;Automation Device;ERROR DETECTED;HP-BLADE
Thu Sep 10 2015 10:29:48;.1.3.6.1.4.1.x.x.3.34;Critical;Status Events;87.200.x.x;77777;Automation Device;ERROR DETECTED;HP-BLADE
Thu Sep 10 2015 13:35:28;.1.3.6.1.4.1.x.x.3.34;Critical;Status Events;87.200.x.x;77777;Automation Device;ERROR DETECTED;HP-BLADE
Thu Sep 10 2015 16:34:49;.1.3.6.1.4.1.x.x.3.34;Critical;Status Events;87.200.x.x;77777;Automation Device;ERROR DETECTED;HP-BLADE

So the preferred output I am looking for is only the date example:
Thu Sep 10 2015 13:35:28

Thanks again all for all your help, this has been driving me nuts!! and I'm sure there is a simple solution. I would prefer a 1 liner and if possible in awk and sed if possible if not I don't mind calling a third party script.

2

A little more information would help:

  1. What operating system are you using?
  2. What shell are you using?
  3. For single digit day of month values, is there a leading space or a leading zero? (I.e., does the code that writes the date stamp use %d or %e to format the day of month?)
  4. Is the date & time in the first file always in the 7th semicolon delimited field?
  5. Is the date & time in the second file always in the 1st semicolon delimited field?
  6. Are the date & time values in the second file always in increasing time order (as in your sample FILE2 contents)?
  7. And, just to be clear, if you find the same date & time in both files, the matching entry in the 2nd file would NOT be selected; is that correct? I.e., you really mean the date & time in the 2nd file must be earlier, not earlier or the same time, than the date & time in the 1st file.
3

Hi Don,
Thank you for the fast reply below are the answers to your questions.

What operating system are you using?

Answer: Debian

What shell are you using?

Answer: Bash

For single digit day of month values, is there a leading space or a leading zero? \(I.e., does the code that writes the date stamp use  ``` %d ```  or  ``` %e ```  to format the day of month?\)

Answer: Correct it is a 0 so for example the 9th would be 09.

Is the date & time in the first file always in the 7th semicolon delimited field?

Answer: Correct it is always on the 7th column / semicolon

Is the date & time in the second file always in the 1st semicolon delimited field?

Answer: Correct it is always on the 1st column / semicolon

Are the date & time values in the second file always in increasing time order (as in your sample FILE2 contents)?
Answer: Correct

And, just to be clear, if you find the same date & time in both files, the matching entry in the 2nd file would NOT be selected; is that correct? I.e., you really mean the date & time in the 2nd file must be earlier, not earlier or the same time, than the date & time in the 1st file.

Answer: It would never be the same time on the first file and the time would always be more than the second file as these are comments added after the value in FILE2 are added. Which means if both times are matching FILE1 would take the previous date/time and not the equal one which means it would always be "earlier" pick.

Thanks again Don for all your help I greatly appreciate all your help!

Sincerely,
Roberto

4

Would this help (assuming Debian's date is GNU date ):

IFS=";" read _ _ _ _ _ _ DT _ < file1
DTS=$(date -d"$DT" +%s)
tac file2 |
while IFS=";" read LG _
  do [ $(date -d"$LG" +%s) -lt $DTS ] \
     && { echo $LG; break; }
  done
Thu Sep 10 2015 13:35:28