某一字段标示的两条数据求时间差值

代号：军刀

1. awk -F '[]"[]' '{if(a[$4 $6 $8] && $(NF-1) == "end"){gsub(/-|:/," ",a[$4 $6 $8]);gsub(/-|:/," ",$2);t=mktime($2)-mktime(a[$4 $6 $8]);sub(/}/,",\"k3\":\""t"\"}",b[$4 $6 $8]);print b[$4 $6 $8]};a[$4 $6 $8]=$2;b[$4 $6 $8]=$0;c[$4 $6 $8]=$(NF-1)}END{for(i in c)if(c[i] == "begin")print b[i]}'

复制代码

代号：军刀

回复 8# messud4312

1. [root@ ~]$ cat test
   
2. 192.168.0.1 [2013-07-02 15:08:11] bj {"k1":"s1","k2":"begin"}
   
3. 192.168.0.1 [2013-07-02 15:11:11] bj {"k1":"s2","k2":"begin"}
   
4. 192.168.0.1 [2013-07-02 15:09:11] bj {"k1":"s1","k2":"end"}
   
5. 192.168.0.1 [2013-07-02 15:14:11] bj {"k1":"s3","k2":"begin"}
   
6. 192.168.0.1 [2013-07-02 15:13:11] bj {"k1":"s2","k2":"end"}
   
7. [root@ ~]$ awk -F '[]"[]' '{if(a[$4 $6 $8] && $(NF-1) == "end"){gsub(/-|:/," ",a[$4 $6 $8]);gsub(/-|:/," ",$2);t=mktime($2)-mktime(a[$4 $6 $8]);sub(/}/,",\"k3\":\""t"\"}",b[$4 $6 $8]);print b[$4 $6 $8]};a[$4 $6 $8]=$2;b[$4 $6 $8]=$0;c[$4 $6 $8]=$(NF-1)}END{for(i in c)if(c[i] == "begin")print b[i]}' test
   
8. 192.168.0.1 [2013-07-02 15:08:11] bj {"k1":"s1","k2":"begin","k3":"60"}
   
9. 192.168.0.1 [2013-07-02 15:11:11] bj {"k1":"s2","k2":"begin","k3":"120"}
   
10. 192.168.0.1 [2013-07-02 15:14:11] bj {"k1":"s3","k2":"begin"}

复制代码

代号：军刀

回复 18# cao627


    来迟了，膜拜下