Selecting Based on Time

[tbohon]

I have a (daily) error file that looks like this:

04/28/05 10:11:07|adt_in|CL71234567|PATIENT '1234567' ALREADY DISCHARGED

Often, due to automatic processes that are running at midnight, I have thousands of these lines to look through for valid errors.

What I need is a quick ksh routine to allow me to pull, from this (date/time) sorted list, any line which has a time stamp (10:11:07 above) that is outside of the 0001-0010 time frame.

Comments greatly appreciated.

Tnx.

Tom

"My mind is like a steel whatchamacallit ...

 

[PHV]

Something like this ?
awk '$2>"00:00:10"' /path/to/logfile > output

Hope This Helps, PH.
Want to get great answers to your Tek-Tips questions? Have a look at FAQ219-2884 or FAQ222-2244

 

[tbohon]

I tried using awk but it got confused ... however, I was very busy that day and may have mis-typed something.

Let me try this and see what happens - will let you know shortly.

Thanks!

Tom

"My mind is like a steel whatchamacallit ...

 

[tbohon]

PH:

Tried it, doesn't change the output report at all.

Here's the code I put into the script:

awk '$2 > "00:00:10"' alreadydischarged.work > discharged2.work

awk 'BEGIN{FS=OFS="|"}{print $1, $2, $3, $4 "\n"}' discharged2.work >> alreadydischarged.out

/usr/sbin/sendmail -t < alreadydischarged.out

Also tried removing the spaces i the first awk statement so it looks like what you suggested above - both times, exact same output as if this line wasn't even there.

Puzzling ...

Tom

"My mind is like a steel whatchamacallit ...

 

[tbohon]

OK - figured out why this awk statement doesn't work - this is the second half of field 1, not field 2 - but now can't figure out how to check just that last part of the field - the time - and ignore the date (which is a variable that changes every day).

Thoughts?

Tnx.

Tom

"My mind is like a steel whatchamacallit ...

 

[p5wizard]

yes with IFS="|", first field contains date and time

try

split ($1,f1," ")

then use
f1[1] for the date
f1[2] for the time

split(str,arr,ERE) splits a string str a at a given ERE (here ERE=space) and puts subfields in an array variable arr, but starting at index 1 - NOT at 0 as is common in C language.

HTH,

p5wizard

 

[vgersh99]

echo '04/28/05 10:11:07|adt_in|CL71234567|PATIENT '1234567' |   awk -F '[| ]' '{printf("date->[%s] time->[%s]\n", $1,$2)}'

vlad
+----------------------------+
| #include<disclaimer.h> |
+----------------------------+