shell筛选出同一ip在2次访问间隔不超过5分钟的记录

0 0

shell筛选出同一ip在2次访问间隔不超过5分钟的记录

有访问日志如下：
127.0.0.1 2012-09-19 00:01:00
127.0.0.2 2012-09-19 00:02:00
127.0.0.3 2012-09-19 00:03:00
127.0.0.1 2012-09-19 00:04:00
127.0.0.2 2012-09-19 00:10:05
127.0.0.1 2012-09-19 00:11:05
127.0.0.3 2012-09-19 00:12:05
127.0.0.1 2012-09-19 00:13:05
127.0.0.1 2012-09-19 00:14:05
....

筛选出同一ip在2次访问间隔不超过5分钟的记录，得到例如
127.0.0.1 2012-09-19 00:01:00
127.0.0.1 2012-09-19 00:04:00
127.0.0.1 2012-09-19 00:11:05
127.0.0.1 2012-09-19 00:13:05
127.0.0.1 2012-09-19 00:14:05
请教shell如何能实现。

awk shell

13 years ago

史巴拉古大师

史巴拉古大师 13 years ago

assuming the journal is inside in_file
字符串时间转化为相对于linux元年的秒数，之后判断时间间隔并输出。只要遇到两个时间差满足条件的两条记录都显示，最后 uniq 去重。

  awk '{
  

  ts=$2" "$3;
  

  gsub(/[-:]/," ",ts);
  

  ts=mktime(ts);
  

  if(ts-rec[$1,0] <= 300)
  

  print $1" "rec[$1,1]"\n"$0;
  

  rec[$1,0]=ts;
  

  rec[$1,1]=$2" "$3;
  

  }' in_file | uniq

answered 13 years ago

茶幾宅D忧郁

茶幾宅D忧郁 answered 13 years ago