请教一日志分析统计shell题

思绪纷飞

有如下文本：
2010-06-22 07:59:59,718 INFO - login, uid:2185147, IP:187.79.95.182
2010-06-22 07:59:59,874 INFO - login, uid:8255422, IP:189.74.28.153
2010-06-22 07:59:59,962 INFO - login, uid:1732168, IP:201.79.122.195
2010-06-22 08:00:01,605 INFO - login, uid:6240401, IP:187.41.104.122
2010-06-22 08:00:03,930 INFO - login, uid:8315245, IP:211.131.49.165
2010-06-22 08:00:04,015 INFO - login, uid:8170363, IP:201.74.144.29
2010-06-22 08:00:06,521 INFO - login, uid:8170001, IP:84.124.226.161
想得到8点之后 uid除以100余1的行。
请写出代码：

expert1

1. 
   
2. :~# awk -F , 'NR>3{if(substr($3,6)%100==1)print }' <<<"2010-06-22 07:59:59,718 INFO - login, uid:2185147, IP:187.79.95.182
   
3. > 2010-06-22 07:59:59,874 INFO - login, uid:8255422, IP:189.74.28.153
   
4. > 2010-06-22 07:59:59,962 INFO - login, uid:1732168, IP:201.79.122.195
   
5. > 2010-06-22 08:00:01,605 INFO - login, uid:6240401, IP:187.41.104.122
   
6. > 2010-06-22 08:00:03,930 INFO - login, uid:8315245, IP:211.131.49.165
   
7. > 2010-06-22 08:00:04,015 INFO - login, uid:8170363, IP:201.74.144.29
   
8. > 2010-06-22 08:00:06,521 INFO - login, uid:8170001, IP:84.124.226.161
   
9. > "
   
10. 2010-06-22 08:00:01,605 INFO - login, uid:6240401, IP:187.41.104.122
    
11. 2010-06-22 08:00:06,521 INFO - login, uid:8170001, IP:84.124.226.161
    

复制代码

iori809

回复 1# 思绪纷飞


    awk  'BEGIN{FS="[ ,]"}{split($2,array,":");split($8,array1,":");if(array[1]>=8 &&array1[2]%100==1){print}}' test
2010-06-22 08:00:01,605 INFO - login, uid:6240401, IP:187.41.104.122
2010-06-22 08:00:06,521 INFO - login, uid:8170001, IP:84.124.226.161

expert1

回复 3# iori809


    呵呵，你这个判断8点以后准吗？万一是 10:01:04这样的格式呢？
其实时间可以根据情况灵活处理，万一不行加个管道再处理也可以的

iori809

回复 4# expert1


    [root@test7: /tmp]#more test
2010-06-22 07:59:59,718 INFO - login, uid:2185147, IP:187.79.95.182
2010-06-22 07:59:59,874 INFO - login, uid:8255422, IP:189.74.28.153
2010-06-22 10:59:59,962 INFO - login, uid:8170001, IP:201.79.122.195
2010-06-22 08:00:01,605 INFO - login, uid:6240401, IP:187.41.104.122
2010-06-22 08:00:03,930 INFO - login, uid:8315245, IP:211.131.49.165
2010-06-22 08:00:04,015 INFO - login, uid:8170363, IP:201.74.144.29
2010-06-22 08:00:06,521 INFO - login, uid:8170001, IP:84.124.226.161
[root@test7: /tmp]#awk  'BEGIN{FS="[ ,]"}{split($2,array,":");split($8,array1,":");if(array[1]>=8 &&array1[2]%100==1){print}}' test
2010-06-22 10:59:59,962 INFO - login, uid:8170001, IP:201.79.122.195
2010-06-22 08:00:01,605 INFO - login, uid:6240401, IP:187.41.104.122
2010-06-22 08:00:06,521 INFO - login, uid:8170001, IP:84.124.226.161

你说哪种呢？我试着还凑活啊

expert1

回复 5# iori809


   
我又看了下，没问题，你这个比较的是小时那个的，我开始以为你比较08这个8呢，遇到10这样的情况就不合适了。
我看错了。

ywlscpl

awk -F '[:, ]+' '$2>=8&&$10%100==1' file

wqfhenanxc

回复 1# 思绪纷飞


     awk -F"[:, ]" '{if($2>=8 && $11%100==1)print}' test

709101040516

awk '{$1=""}1' URFILE | awk -F':' '{if($1>7 && $4%100==1)print}

mercuyr

awk '$2!~/^0[0-7]/ && $6~/01,$/{print $0}'  urfile