Can AWK do time arithmetic? If so, how? 2

[630111]

I have two log entries as follows:

Mar 3 19:03:00 p0690b01 root: [ID 702911 daemon.notice] Start time: Wed Mar 3 19:00:01 2004

Mar 3 19:03:00 p0690b01 root: [ID 702911 daemon.notice] End time: Wed Mar 3 19:02:59 2004

(each entry is one line, but is displayed as two)

Anyway, I'd like to subtract the end time from the start time. Also, it is possible that the start time will be on one day, and the end time will be the next day.

Any help would be appreciated!

Thanks!
630111

 

[PHV]

If you have no control on the way the data are build, I suggest you the Perl forum: Forum219

Hope This Help, PH.
Want to get great answers to your Tek-Tips questions? Have a look at FAQ219-2884

 

[CaKiwi]

If you must use awk, try this. It assumes the start and end times do not go over more that 2 days.

/Start time:/ {
split($(NF-1),a,":")
ssec = ((a[1]*60+a[2])*60+a[3])
}
/End time:/ {
split($(NF-1),a,":")
esec = ((a[1]*60+a[2])*60+a[3]) - ssec
if (esec < 0) esec += 24*60*60
mn = int (esec / 60)
sc = esec % 60
hr = int (mn / 60)
mn = mn % 60
printf "%02d:%02d:%02d\n", hr,mn,sc
}

CaKiwi

 

[futurelet]

# Assumes that the elapsed time is
# less than one week.
/Start time:/ { parse(start) }

/End time:/ { parse(end); calc() }

function parse( arr,      tempa )
{ arr[1]= $(NF-4)
  arr[2]= $(NF-1)
  arr[1]=index("SunMonTueWedThuFriSat",arr[1])
  arr[1]= int((arr[1]-1)/3) + 1
  split(arr[2],tempa,/:/)
  arr[2]=60*(60*tempa[1]+tempa[2])+tempa[3]
}
function calc(    secs, mins, hours)
{ if (end[1]<start[1])
    end[1] += 7
  secs = (end[1] - start[1])*24*60*60
  secs += end[2] - start[2]
  hours= int(secs/60/60)
  secs -= hours*60*60
  mins= int(secs/60)
  secs -= mins*60
  print hours ":" mins ":" secs
}

Let me know whether or not this helps.

 

[630111]

Thank you CaKiwi and futurelet for your replies. Much appreciated!

I saved both your posts as a file called purge.awk and ran it as follows:

# awk -f purge.awk mylog.log

futurelet, I got an error when I ran yours. This is under Solaris 9 on SPARC.

awk: syntax error near line 5
awk: illegal statement near line 5
awk: syntax error near line 7
awk: bailing out near line 7

Thanks again!
630111

 

[PHV]

630111, take a try with nawk

Hope This Help, PH.
Want to get great answers to your Tek-Tips questions? Have a look at FAQ219-2884

 

[futurelet]

You are probably using a very old, obsolete version of awk.
Try [tt]nawk[/tt]. It seems that yours is so old that it doesn't even let you define functions. The code runs under modern awk, gawk, and mawk, so it should work with nawk.

 

[630111]

Thanks futurelet and PHV, nawk did the trick!

630111