某一字段标示的两条数据求时间差值

messud4312

有数据如下：

1. 192.168.0.1 [2013-07-02 15:08:11] bj {"k1":"s1","k2":"begin"}
   
2. 192.168.0.1 [2013-07-02 15:09:11] bj {"k1":"s1","k2":"end"}
   
3. 192.168.0.1 [2013-07-02 15:11:11] bj {"k1":"s2","k2":"begin"}
   
4. 192.168.0.1 [2013-07-02 15:13:11] bj {"k1":"s2","k2":"end"}
   
5. 192.168.0.1 [2013-07-02 15:14:11] bj {"k1":"s3","k2":"begin"}

复制代码

现在想变为

1. 192.168.0.1 [2013-07-02 15:08:11] bj {"k1":"s1","k2":"begin","k3":"60"}
   
2. 192.168.0.1 [2013-07-02 15:11:11] bj {"k1":"s2","k2":"begin","k3":"120"}
   
3. 192.168.0.1 [2013-07-02 15:14:11] bj {"k1":"s3","k2":"begin"}

复制代码

即k1是一样的两条记录，计算时间差值，写入k3，并合并为一条。k1没有一样的，就单独列出来
求大神

yinyuemi

回复 1# messud4312

1. awk -F'[],[]' '{cmd="date -d \""$2"\" \"+%s\"";cmd|getline time;a[$3] = a[$3]? time-a[$3] : time;b[$3]++;c[$3]=$1"["$2"]"$3}END{for(i in a){if(b[i]==2){print c[i]",\"k2\":\"begin\",\"k3\":\""a[i]"\"}"}else{print c[i]",\"k2\":\"begin\"}"}}}'

复制代码

WilliBhamlll

1. awk -F: -vq='"' '/begin/{a=$2;getline;if($0~/end/){b=(gensub(/[^:]*:([^:]*):.*/,"\\1","1")-a)*60;sub("}",","q"k3"q":"q b q"}");print}else print}' file
   
2. 192.168.0.1 [2013-07-02 15:09:11] bj {"k1":"s1","k2":"end","k3":"60"}
   
3. 192.168.0.1 [2013-07-02 15:13:11] bj {"k1":"s2","k2":"end","k3":"120"}
   
4. 192.168.0.1 [2013-07-02 15:14:11] bj {"k1":"s3","k2":"begin"}

复制代码

messud4312

谢谢两位大神，我先看下

messud4312

回复 3# WilliBhamlll

1. awk -F: -vq='"' '/begin/{a=$2;getline;if($0~/end/){b=($2-a)*60;sub("}",","q"k3"q":"q b q"}");print}else print}'

复制代码

这样也行，不过请教下
sub("}",","q"k3"q":"q b q"}");
这里"q q"是什么意思


   

messud4312

回复 2# yinyuemi
你这里考虑了整个时间转化成秒，适应性比较强


   

代号：军刀

1. awk -F '[]"[]' '{if(a[$4 $6 $8] && $(NF-1) == "end"){gsub(/-|:/," ",a[$4 $6 $8]);gsub(/-|:/," ",$2);t=mktime($2)-mktime(a[$4 $6 $8]);sub(/}/,",\"k3\":\""t"\"}",b[$4 $6 $8]);print b[$4 $6 $8]};a[$4 $6 $8]=$2;b[$4 $6 $8]=$0;c[$4 $6 $8]=$(NF-1)}END{for(i in c)if(c[i] == "begin")print b[i]}'

复制代码

messud4312

ths   代号：军刀

WilliBhamlll

回复 5# messud4312


    是啊，我写复杂了。

q是定义的变量，将双引号赋值给变量q
-vq='"'

sub("}",","q"k3"q":"q b q"}")，意思是将}替换成","q"k3"q":"q b q"}"

代号：军刀

回复 8# messud4312

1. [root@ ~]$ cat test
   
2. 192.168.0.1 [2013-07-02 15:08:11] bj {"k1":"s1","k2":"begin"}
   
3. 192.168.0.1 [2013-07-02 15:11:11] bj {"k1":"s2","k2":"begin"}
   
4. 192.168.0.1 [2013-07-02 15:09:11] bj {"k1":"s1","k2":"end"}
   
5. 192.168.0.1 [2013-07-02 15:14:11] bj {"k1":"s3","k2":"begin"}
   
6. 192.168.0.1 [2013-07-02 15:13:11] bj {"k1":"s2","k2":"end"}
   
7. [root@ ~]$ awk -F '[]"[]' '{if(a[$4 $6 $8] && $(NF-1) == "end"){gsub(/-|:/," ",a[$4 $6 $8]);gsub(/-|:/," ",$2);t=mktime($2)-mktime(a[$4 $6 $8]);sub(/}/,",\"k3\":\""t"\"}",b[$4 $6 $8]);print b[$4 $6 $8]};a[$4 $6 $8]=$2;b[$4 $6 $8]=$0;c[$4 $6 $8]=$(NF-1)}END{for(i in c)if(c[i] == "begin")print b[i]}' test
   
8. 192.168.0.1 [2013-07-02 15:08:11] bj {"k1":"s1","k2":"begin","k3":"60"}
   
9. 192.168.0.1 [2013-07-02 15:11:11] bj {"k1":"s2","k2":"begin","k3":"120"}
   
10. 192.168.0.1 [2013-07-02 15:14:11] bj {"k1":"s3","k2":"begin"}

复制代码