comparing 2 dates in the log file

Question

I have the following long file

2012-01-30 12:41:06,214 app10 device INFO [2012-01-30 12:40:46,214] info1 info2 info3 ...

this is come from remote offline devices and it means if teh device's time (2nd time) setting are not correct it points to the future. If the 2nd time is points to the future, I would like to change it to the 1st date. If this is the same or in the past, I would like to leave it as is. Only the date is important, the time is not needed at all. After the 2nd time we have several data and sometimes different number of columns we would like to keep.

example:

2012-01-30 12:41:06,214 app10 device INFO [2013-01-30 12:40:46,214] info1 info2 info3 ...

should be

2012-01-30 app10 device INFO 2012-01-30 info1 info2 info3 ...

we would like to run this from a script, so I prefer bash, sed, awk or perl solution. thank you for your help

http://stackoverflow.com/questions/5895159/bash-script-compare-two-date-variables — Oleksandr Kravchuk, Nov 15 '12 at 09:06
Does what you've posted as sample input/output show an example of your statement that "If the 2nd time is points to the future, I would like to change it to the 1st date. If this is the same or in the past, I would like to leave it as is."? — Ed Morton, Nov 15 '12 at 18:22

glenn jackman · Accepted Answer · 2012-11-15T16:08:38.357

2

awk -F '[[:space:][]+' '
    $6 > $1 {$6 = $1} 
    {
        for (i=7; i<NF; i++) {$i = $(i+1)}; NF--   # delete time field 7
        for (i=2; i<NF; i++) {$i = $(i+1)}; NF--   # delete time field 2
        print
    } 
' <<< "2012-01-30 12:41:06,214 app10 device INFO [2222-33-44 12:40:46,214] info1 info2 info3 ..."

outputs

2012-01-30 app10 device INFO 2012-01-30 info1 info2 info3 ...

edited Nov 15 '12 at 16:08

answered Nov 15 '12 at 14:35

glenn jackman

238,783
38
220
352

score 0 · Answer 2 · answered Nov 15 '12 at 09:41

Well this might work for you but it adds an extra space before the second date/time and I'm leaving it to you to figure out how to remove it:

awk 'BEGIN { FS="[ \\[]" } 
{ if ( gensub("-","","g",$1) < gensub("-","","g",$7) ) { $7 = $1 }
  $7 = "[" $7
  print
}' INPUTFILE

You can see it in action here @ Ideone.com.

German Garcia · Answer 3 · 2012-11-20T19:00:32.447

0

Another gnu awk alternative. This one keeps original lines unchanged if 2nd date is not changed:

awk -F '[][ \t]+' '$6>$1 {$6=$1; $2=$7=""; gsub(OFS"+", OFS);} 1' file

edited Nov 20 '12 at 19:00

answered Nov 20 '12 at 15:56

German Garcia

1,209
14
14

Assigning any value to a field will cause awk to recompile the record, replacing FS with OFS, so the gsub() will do nothing. – Ed Morton Nov 20 '12 at 16:43
@EdMorton you're partially right, assigning any value to a field will cause awk to recompile the record, but here the idea is to avoid the extra, "spurious" fields left by the reassignment to $2 and $7. And that is done by the gsub. If you take out the gsub, then $2 and $7 show as extra spaces (OFS) in the output, which I think is best avoided. Cheers. – German Garcia Nov 20 '12 at 17:01
Ah, I see. Then you should change your gsub() to `gsub(OFS"+",OFS)` for robustness and clarity since the gsub() is being executed after all of the FSs have already been changed to OFSs and your intent is to convert each sequence of contiguous OFSs to a single OFS. – Ed Morton Nov 20 '12 at 17:33

comparing 2 dates in the log file

3 Answers3