Need to search for keywords within files modified at a certain time

UNIX for Advanced & Expert Users
1

I have a huge list of files in an Unix directory (around 10000 files).

I need to be able to search for a certain keyword only within files that are modified between certain date and time, say for e.g 2012-08-20 12:30 to 2012-08-20 12:40

Can someone let me know what would be the fastest way to perform this search?

I tried using find . -exec grep -l "searchword" {} \; and it is taking a lot of time to perform the search as it searches within all the files in the directory.

I am not very much familiar with Unix.. Any help you could provide is greatly appreciated. Thanks!

2

Create two files with touch:

touch -t 201208201230 dummy1
touch -t 201208201240 dummy2
find .   \( -newer dummy1 -a ! -newer dummy2 \)  -exec grep -l "searchword" {} \;
3

I don't have write permissions to the directory. Hence I cannot execute this

touch: cannot touch `dummy1': Permission denied
touch: cannot touch `dummy': Permission denied
touch: cannot touch `2': Permission denied

Is it possible to let me know one single find command, without writing to a dummy file? Similar to the one below;

for i in $(find -name "*file1*" -o -name "*file2*" );do find $i -ls ; cat $i | grep -i searchword ; done

I use this command to search for a keyword within several files where I know the file name. In this case, I do not know the file name, and I need to search all the files created between two specific dates.

4

So write them somewhere else. It doesn't matter where they are. /tmp/ will do.

Dummy files really is the most straightforward way on a lot of systems.

5

I just executed the below script in the command line and this doesn't seem to work. Please help.

touch -t 201208271230 /home/n0149941/dummy1 ;touch -t 201208271240 /home/n0149941/dummy2; find .   \( -newer /home/n0149941/dummy1 -a ! -newer /home/n0149941/dummy2 \)  -exec grep -l "023758874" {} \;
6

In what way does it not work? Try substituting 'echo' for 'grep' and see what it prints then?

7

i just tried substituting echo for grep and it lists a whole bunch of files. here is the command I used and the results. I am trying to search for the keyword 023758874 in the files. It just lists around 80 files and none of these files have this searched keyword.

$ touch -t 201208271230 /home/n0149941/dummy1 ;touch -t 201208271240 /home/n0149941/dummy2; find .   \( -newer /home/n0149941/dummy1 -a ! -newer /home/n0149941/dummy2 \)  -exec echo -l "023758874" {} \;
-l 023758874 ./4imlaep9tu9.data.dat
-l 023758874 ./4imlaep9bbu.data.dat
-l 023758874 ./4imlbcc7evw.data.dat
-l 023758874 ./4imlbwaupvi.data.dat
-l 023758874 ./4imlc67k4x7.data.dat
-l 023758874 ./4imlc7nzmxy.data.dat
-l 023758874 ./4imlcse2k81.data.dat
-l 023758874 ./4imld2t4edz.data.dat
-l 023758874 ./4imldlk3ni5.data.dat
-l 023758874 ./4imldvyzd93.data.dat
-l 023758874 ./4imldxm1njw.data.dat
-l 023758874 ./4imldzj4098.data.dat
-l 023758874 ./4imle0xg69h.data.dat
-l 023758874 ./4imle3ri5oy.data.dat
-l 023758874 ./4imle52y8e7.data.dat
-l 023758874 ./4imlefi9ljc.data.dat
-l 023758874 ./4imlegdr9ct.data.dat
-l 023758874 ./4imlejmedy4.data.dat
-l 023758874 ./4imlelcv1lw.data.dat
-l 023758874 ./4imleon11cm.data.dat
-l 023758874 ./4imlep5jz1s.data.dat
-l 023758874 ./4imleq359pa.data.dat
-l 023758874 ./4imlery8e5i.data.dat
-l 023758874 ./4imlezyoz5x.data.dat
-l 023758874 ./4imlf1kbu9p.data.dat
-l 023758874 ./4imlf2ygsi5.data.dat
-l 023758874 ./4imlf3e6sg3.data.dat
-l 023758874 ./4imlf52g38z.data.dat
-l 023758874 ./4imlf7a2871.data.dat
-l 023758874 ./4imlf9xyi7b.data.dat
-l 023758874 ./4imlfaf3vv9.data.dat
-l 023758874 ./4imlfffuyny.data.dat
-l 023758874 ./4imlfh3ifd1.data.dat
-l 023758874 ./4imlfidx12c.data.dat
-l 023758874 ./4imlfmiv2e2.data.dat
-l 023758874 ./4imlfoooizd.data.dat
-l 023758874 ./4imlfslme1z.data.dat
-l 023758874 ./4imlfuvu2j7.data.dat
-l 023758874 ./4imlfwogsp6.data.dat
-l 023758874 ./4imlfxyxnx4.data.dat
-l 023758874 ./4imlfz91pc7.data.dat
-l 023758874 ./4imlg19ioyt.data.dat
-l 023758874 ./4imlg6zw38r.data.dat
-l 023758874 ./4imlg898g8c.data.dat
-l 023758874 ./4imlga3fklg.data.dat
-l 023758874 ./4imlgfp3trs.data.dat-
8

I have no idea why you post code is so different from the good advice in post #2.

Why does your failing command contain "echo" when the original advice contained "grep". Please post the full script and any error messages.

Ps. It is very bad practice to string commands together with semi-colons. It makes the code virtually unreadable.

9

Because I told him to, so I could see which files it was trying to match.

10

Yes... And do they happen to be the right files, or the wrong files?

If they are the wrong files, in what way are they wrong? Too old? Too new?

11

They are not the right files, as they none of these files have the keyword I am searching for. I tried to break up your command for testing
$ touch 201209200700 /tmp/dummy1
$ touch 201209200800 /tmp/dummy2
$ find . \( -newer /tmp/dummy1 -a ! -newer /tmp/dummy2 \)

This should list all files modified after 7 am today and before 8 am today, correct?
but the output of the above commands is just one file and that was created at 10:42 am, which doesn't look right to me.
-rw-r----- 1 spprt 6590 Sep 20 10:42 data.dat

Any thoughts? Please assist.