1

I am running Solaris and my log file starts like this:

TID: [0] [AS] [2018-10-03 10:36:57,958] DEBUG...

I am looking to output only the last five minutes of the log file. I have tried SED/AWK/GREP but I think I have the wrong regex format.

EDIT: Code already used

d1=$(date --date="-10 min" "+%b %_d %H:%M") d2=$(date "+%b %_d %H:%M") while read line; do [[ $line > $d1 && $line < $d2 || $line =~ $d2 ]] && echo $line done

awk -vDate="date -d'TZ="UTC" now-10 minutes' +'%Y-%m-%d %H:%M:%S.%3N'" '$1" "$2 > Date {print Date, $0}'

sed -n "/^$(date --date='10 minutes ago' '+%b %_d %H:%M')/,\$p" <log file location here>
  • 4
    Welcome to SO. Stack Overflow is a question and answer site for professional and enthusiast programmers. The goal is that you add some code of your own to your question to show at least the research effort you made to solve this yourself. – Cyrus Oct 03 '18 at 16:00
  • d1=$(date --date="-10 min" "+%b %_d %H:%M") d2=$(date "+%b %_d %H:%M") while read line; do [[ $line > $d1 && $line < $d2 || $line =~ $d2 ]] && echo $line done –  Oct 03 '18 at 16:48
  • sed -n "/^$(date --date='10 minutes ago' '+%b %_d %H:%M')/,\$p" –  Oct 03 '18 at 16:48
  • awk -vDate="`date -d'TZ="UTC" now-10 minutes' +'%Y-%m-%d %H:%M:%S.%3N'`" '$1" "$2 > Date {print Date, $0}' –  Oct 03 '18 at 16:49
  • 1
    please don't make readers wade thru hard to read comments to understand your problem. Your example code should be in the body of your Q (above). Use 4 spaces at the front of each line you want to appear formatted as code/data/error messages. Please read the [help] and [mcve] before posting more Qs here. AND, did you try searching for a solution here? It seems to me that this sort of Q gets asked almost every week. Good luck. – shellter Oct 03 '18 at 17:10
  • Hi, yes I did. The commands did not work for me. –  Oct 03 '18 at 17:16
  • Your Awk script might actually work if you used the right fields. In your example, the date is not in the fields `$1` and `$2`. – tripleee Oct 03 '18 at 17:28
  • Good show, updating your Q. Now help save people's time by not having to read the same information in the comments (please delete them). Good luck. – shellter Oct 03 '18 at 18:23
  • This question is asked about once a week - search the archives. – Ed Morton Oct 03 '18 at 21:18

0 Answers0