bash - Need a script to split a large file by month that can determine year based off order of the logs -
i need split large syslog file goes october 2015 february 2016 , separated month. due background log retention, format of these logs similar to:
oct 21 08:00:00 - log info nov 16 08:00:00 - log info dec 25 08:00:00 - log info jan 11 08:00:00 - log info feb 16 08:00:00 - log info
this large file result of initial zgrep search across large amount of log files split day. example being, user activity on network across multiple services such windows/firewall/physical access logs.
for previous request, used following:
gawk 'begin{ m=split("jan|feb|mar|apr|may|jun|jul|aug|sep|oct|nov|dec",mth,"|") } { for(i=1;i<=m;i++){ if ( mth[i]==$1){ month = } } tt="2015 "month" "$2" 00 00 00" date= strftime("%y%m",mktime(tt)) print $0 > filename"."date".txt" } ' logfile
output file examples (note add "%d" day not time:
test.201503.txt test.201504.txt test.201505.txt test.201506.txt
this script adds 2015 manually output log file name. attempted, , failed do, script creates variables out of each month @ 1-12 , sets 2015 variable (a) , 2016 variable (b). script able compare when going in order of 10, 11, 12, 1, 2 go in order , once gets 1 < 12 (the previous month) know use 2016 instead of 2015. odd request know, ideas @ least me in right mindset.
you use date
parse date , time. e.g.
#!/bin/bash while ifs=- read -r time info; mon=$(date --date "$time" +%m | sed 's/^0//') if (( mon < 10 )); year=2016 else year=2015 fi echo $time - $info > test.$year$(printf "02d%" $mon).txt done
Comments
Post a Comment