I feel like there has to be a better way than what I'm describing below. But nothing beyond Perl / Python / etc. come to mind.
But a convoluted she / awk answer is:
- convert the month (%b), day (%e), and time (%H:%M:%S) to seconds since the epoch (%s)
- compare numbers to numbers to find the range you want
- convert the seconds since the epoch (%s) back to month (%b), day (%e), and time (%H:%M:%S).
Here is a proof of concept that I just hacked together on my system to do step #1 and #3 above.
tail /var/log/messages | awk '{cmd = "date \"+%s\" -d \""$1" "$2" "$3"\""; cmd | getline date; sub(/... .. ..:..:../, date, $0);print}' | awk '{cmd = "date \"+%b %e %H:%M:%S\""; cmd | getline date; sub(/........../, date, $0); print}'
Here's the first awk broken up:
awk '{
cmd = "date \"+%s\" -d \""$1" "$2" "$3"\""
cmd | getline date
sub(/... .. ..:..:../, date, $0)
print
}'
The awk + date above converts this:
Apr 1 12:13:05 omega last message buffered 1 times
to this:
1711991585 omega last message buffered 1 times
Here's the second awk broken up:
awk '{
cmd = "date \"+%b %e %H:%M:%S\""
cmd | getline date
sub(/........../, date, $0)
print
}'
The awk + date above converts this:
1711991585 omega last message buffered 1 times
to this:
Apr 1 12:13:05 omega last message buffered 1 times
You should be able to easily insert another awk in between the two that does a numeric comparison of the date & time in seconds since epoch (%s) form.
It should be relatively trivial to make the interstitial awk automatically select a time range if you want the last X number of days. -- Make date (read: the computer) do the work to calculate the start and stop dates.
Let me know if you want help with the interstitial awk (I'm on my lunch break and don't have much time).