使用shell如何取出web日志中的一段时间的日志

liu-shaobo

回复 10# yestreenstars


    ，偷懒一下

1.     awk '/19\/Nov\/2012:11:00:01/,/19\/Nov\/2012:12:00:02/ {print}' logfile |grep -v “2012:12:00:02”

复制代码

yestreenstars

回复 11# liu-shaobo


    没用的，你排除得了12:00:02的，难道还排除得了12:00:03、12:00:04、12:00:05……的吗？

yestreenstars

回复 11# liu-shaobo


    刚才在忙，没时间写命令，现在写了一个：

1. sed -n '/19\/Nov\/2012:11:00:01/{:1;H;n;/19\/Nov\/2012:12:00:01/{:2;H;n;/19\/Nov\/2012:12:00:01/!{g;s/\n//;p;b};${H;g;s/\n//;p};b2};b1}' file

复制代码

liu-shaobo

这个好复杂

代号：军刀

回复 6# yestreenstars


    没看仔细，以为要取11点到12点的数据，现在我把正确的补上

1. awk -F "[ /:]" '{if($6$7$8$9 >= 2012110001 && $6$7$8$9 <=2012120001)print}' file

复制代码

yestreenstars

回复 15# 代号：军刀


    加上月和日才算完善。

代号：军刀

回复 16# yestreenstars


  

1. awk -F "[ /:]" '/19\/Nov\/2012/{if($6$7$8$9 >= 2012110001 && $6$7$8$9 <=2012120001)print}' file

复制代码

fly83107

恩，谢谢！

inchonline

回复 1# fly83107

wyc@ubuntu:~/ex$ cat >test.txt
115.67.100.159 - - [19/Nov/2012:05:00:01 +0100] "GET /favicon.ico HTTP/1.1" 404 564 "-" "Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.11 (KHTML, like Gecko) Chrome/23.0.1271.64 Safari/537.11"
154.5.137.229 - - [19/Nov/2012:05:00:01 +0100] "GET /favicon.ico HTTP/1.1" 404 162 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:16.0) Gecko/20100101 Firefox/16.0"
115.67.100.159 - - [19/Nov/2012:10:00:01 +0100] "GET /favicon.ico HTTP/1.1" 404 564 "-" "Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.11 (KHTML, like Gecko) Chrome/23.0.1271.64 Safari/537.11"
154.5.137.229 - - [19/Nov/2012:11:00:01 +0100] "GET /favicon.ico HTTP/1.1" 404 162 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:16.0) Gecko/20100101 Firefox/16.0"
115.67.100.159 - - [19/Nov/2012:11:05:01 +0100] "GET /favicon.ico HTTP/1.1" 404 564 "-" "Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.11 (KHTML, like Gecko) Chrome/23.0.1271.64 Safari/537.11"
154.5.137.229 - - [19/Nov/2012:11:10:01 +0100] "GET /favicon.ico HTTP/1.1" 404 162 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:16.0) Gecko/20100101 Firefox/16.0"
154.5.137.229 - - [19/Nov/2012:12:00:01 +0100] "GET /favicon.ico HTTP/1.1" 404 162 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:16.0) Gecko/20100101 Firefox/16.0"
115.67.100.159 - - [19/Nov/2012:13:00:01 +0100] "GET /favicon.ico HTTP/1.1" 404 564 "-" "Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.11 (KHTML, like Gecko) Chrome/23.0.1271.64 Safari/537.11"

wyc@ubuntu:~/ex$ perl -lne 'print if (/(\d+:\d+:\d+:\d)/g && $1 gt "2012:11:00:01" && $1 lt "2012:12:00:01")'  test.txt  
115.67.100.159 - - [19/Nov/2012:11:05:01 +0100] "GET /favicon.ico HTTP/1.1" 404 564 "-" "Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.11 (KHTML, like Gecko) Chrome/23.0.1271.64 Safari/537.11"
154.5.137.229 - - [19/Nov/2012:11:10:01 +0100] "GET /favicon.ico HTTP/1.1" 404 162 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:16.0) Gecko/20100101 Firefox/16.0"
154.5.137.229 - - [19/Nov/2012:12:00:01 +0100] "GET /favicon.ico HTTP/1.1" 404 162 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:16.0) Gecko/20100101 Firefox/16.0"