I am trying to filter some output with an "if" in an "awk" command but I cant seem to find the right syntax for time.
Command:
ps -ef -o comm -o time
Output:
/usr/../../ddterm 0:40
/bin/csh 11:30
/user/../../graph 30:00
....... ......
I want to pull the processes that have been running for more than 12 hours.
ps -ef -o comm -o time | awk '{if ($2 -gt 12) print}'
Any help would be greatly appreciated.
And yes, I did utilize the search function.
You didn't say what shell, but here's how I'd do it in ksh:
ps -ef -o comm= -o time= | awk -F: '$2 > 12 {print}'
Thanks for such a quick reply.
Any shell is fine by me.
Heres the problem though, that will filter by the minutes.
So it will not display:
a process with the time 18:16:(10 <----not greater than 12)
-o time option displays time as [[dd-]hh::]mm:ss
So..a Process running for 13 days-10 hours looks like this:
13-10:57:33
So I need to evaluate it as a whole, or the hour column along with the day column.
-----
part of the post was displaying as a smily...
Oops. Yeah, I was running PS on our system and nothing came up as running over 24 hours, so I forgot a 1- or 2-, etc will show up...
Let's try this convoluted looking line instead: 
ps -ef -o comm= -o time= | awk '/[0-9]-[0-9][0-9]:[0-9][0-9]:[0-9][0-9]/ || substr($2,1,2) > 12 {print $0}'
This way, if either the process is running a day or more (and something like 1- or 2- is present) or the hour section of the running time is greater than 12, then the line prints.
I took the first part of the awk command and used that. Changing the 12 hour criteria to anything over a day.
But I'd like to figure this out, I've been trying for the last few hours, but my scripting, programming is not up to snuff.
taking the input of:
command1 38:41
command2 0:07
command3 3-11:37:51
command4 1:45
command5 1-04:00:50
the:
substr($2,1,2) > 12
will print commands 1,3,4
That substr will evaluate the first two digits is comes across totally disregarding the special characters ":" and "-"
so command4 1:45 = true because 14 > 12
command5 1-04:00:50 = false because 1-0 < 12 though this is more than 12 hours, which I want.
Do you think it would be possible to format this with the awk version of split?
I made that script on the assumption that if something's been running 1 minute and 45 seconds, it'd show up as 00:01:45 (as it does on my system) and not 1:45 (as you have it).
It gets even more convoluted... this displays any entry that shows a day (blue part) OR shows an hour greater than or equal to 12 (red part).
ps -ef -o comm= -o time= | awk '/[1-9]-[0-9][0-9]:[0-9][0-9]:[0-9][0-9]/ || /[1-2][2-9]:[0-9][0-9]:[0-9][0-9]/ || /[2][0-9]:[0-9][0-9]:[0-9][0-9]/ {print $0}'
Don't know why I didn't think of that, saw the substr and got tunnel vision. (sheepish grin)
Thanks for the help! 