提取列Awk的一部分

Question

I am trying to count the number of occurrences per second in a log file for a term searched. I've been using AWK and have the issue of the time stamp being locate in a column with additional information. Is it possible to get the number of occurrences per second by only looking for the time pattern 00:00:00 - 24:00:00?

Data example:

[01/May/2018:23:59:59.532
[01/May/2018:23:59:59.848
[01/May/2018:23:59:59.851
[01/May/2018:23:59:59.911
[01/May/2018:23:59:59.923
[01/May/2018:23:59:59.986
[01/May/2018:23:59:59.988
[01/May/2018:23:59:59.756
[01/May/2018:23:59:59.786
[01/May/2018:23:59:59.883

So far I can extract the data easily enough using:

awk '/00:00:00/,/24:00:00/{if(/search_term/) a[$4]++} END{for(k in a) print k " - " a[k]}' file.log |sort

This will return:

[02/May/2018:10:40:05.903 - 1
[02/May/2018:10:40:05.949 - 1
[02/May/2018:10:40:05.975 - 1
[02/May/2018:10:40:05.982 - 2
[02/May/2018:10:40:06.022 - 1
[02/May/2018:10:40:06.051 - 1
[02/May/2018:10:40:06.054 - 1
[02/May/2018:10:40:06.086 - 1
[02/May/2018:10:40:06.094 - 1
[02/May/2018:10:40:06.126 - 1

What I'm aiming for is more:

10:40:05 - 5
10:40:06 - 6

No idea if I'm even thinking about this correctly. New to AWK in general.

Answer 1

Use colon and dot as the field separators, and we have hours in col2, minutes in col3 and seconds in col4

awk -F'[:.]' '
    {count[$2 ":" $3 ":" $4]++} 
    END {for (time in count) print time " - " count[time]}
' file

10:40:05 - 4
10:40:06 - 6

Output will not necessarily be sorted. If you're using GNU awk, use

END {
    PROCINFO["sorted_in"] = "@ind_str_asc"
    for (time in count) 
        print time " - " count[time]
}

( reference ), or simply pipe the output to | sort | sort

Answer 2

One thing you can do is this:

awk 'BEGIN{FIELDWIDTHS = "1 11 1 12"} {print $4}' datetimes

Specify the field widths and then this will give you your time, for example. If you don't care about milliseconds, then "1 11 1 8 4"

Answer 3

You can use substr for the line as index of an array. for example, you have this file

cat 1.txt
[01/May/2018:23:59:59.532
[01/May/2018:01:59:59.848
[01/May/2018:02:59:59.851
[01/May/2018:02:59:59.911
[01/May/2018:02:59:59.923
[01/May/2018:02:00:59.986

you can use an awk command like this

cat 1.txt | awk '{a[substr($0,index($0,":")+1,8)]++} END{for(i in a) print i" - "a[i]}'

where substr($0,index($0,":")+1,8) cuts 8 chars from the occurrence of the first ":", use this as index of the array