StackOverflow2013

Note that there are some explanatory texts on larger screens.

plurals

PO
text
Body
copied!<p>It may be possible in a Bash environment but you should really take advantage of tools that have more built-in support for working with Strings and Dates. For instance Ruby seems to have the built in ability to parse your Date format. It can then convert it to an easily comparable Unix Timestamp (a positive integer representing the seconds since the epoch).</p> <pre><code>irb> require 'time' # => true irb> Time.parse("May 3 13:21:12").to_i # => 1241371272 </code></pre> <p>You can then easily write a Ruby script:</p> <ul> <li>Provide a start and end date. Convert those to this Unix Timestamp Number.</li> <li>Scan the log files line by line, converting the Date into its Unix Timestamp and check if that is in the range of the start and end dates.</li> </ul> <p>Note: Converting to a Unix Timestamp integer first is nice because comparing integers is very easy and efficient to do.</p> <p>You mentioned "without comparing every single line." Its going to be hard to "guess" at where in the log file the entries starts being too old, or too new without checking all the values in between. However, if there is indeed a monotonically increasing trend, then you know immediately when to stop parsing lines, because as soon as the next entry is too new (or old, depending on the layout of the data) you know you can stop searching. Still, there is the problem of finding the first line in your desired range.</p> <hr> <p>I just noticed your edit. Here is what I would say:</p> <p>If you are <em>really</em> worried about efficiently finding that start and end entry, then you could do a binary search for each. Or, if that seems like overkill or too difficult with bash tools you could have a heuristic of reading only 5% of the lines (1 in every 20), to quickly get a close to exact answer and then refining that if desired. These are just some suggestions for performance improvements.</p>

Querying!

Guidance

An individual column

Larger individual text columns get their own page to allow for proper reading.

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload