Note that there are some explanatory texts on larger screens.

plurals
  1. PO
    primarykey
    data
    text
    <p>Extending <a href="https://stackoverflow.com/a/17068885/970195">Ed Morton's</a> solution: </p> <h2>Content of script.awk</h2> <pre><code>function parse_time (date, time, newtime) { gsub(/-/, " ", date) gsub(/:/, " ", time) gsub(/,.*/, "", time) newtime = date" "time return newtime } (gensub(/.*;gt;([^&amp;]+).*/,"\\1","") in starttime) { etime = parse_time($1, $2) endtime[gensub(/.*;gt;([^&amp;]+).*/,"\\1","")] = etime next } { stime = parse_time($1, $2) starttime[gensub(/.*;gt;([^&amp;]+).*/,"\\1","")] = stime } END { for (x in starttime) { for (y in endtime) { if (x==y) { diff = mktime(endtime[x]) - mktime(starttime[y]) diff = sprintf("%dh:%dm:%ds",diff/(60*60),diff%(60*60)/60,diff%60) print x, diff delete starttime[x] delete endtime[y] } } } } </code></pre> <h3>Test: Modified the order of guid for testing</h3> <pre><code>$ cat log.file 2013-04-03 08:54:19,989 INFO [LOGGER] &lt;?xml version="1.0" encoding="UTF-8" standalone="yes"?&gt;&lt;event&gt;&lt;body&gt;&amp;amp;lt;UId&amp;amp;gt;904c-be-4e-bbda-3e62&amp;amp;lt;/UId&amp;amp;gt;&amp;amp;lt;&lt;/body&gt;&lt;/event&gt; 2013-04-03 08:54:34,979 INFO [LOGGER] &lt;?xml version="1.0" encoding="UTF-8" standalone="yes"?&gt;&lt;event&gt;&lt;body&gt;&amp;amp;lt;UId&amp;amp;gt;edfc-fr-5e-bced-3443&amp;amp;lt;/UId&amp;amp;gt;&amp;amp;lt;&lt;/body&gt;&lt;/event&gt; 2013-04-03 08:54:39,389 INFO [LOGGER] &lt;?xml version="1.0" encoding="UTF-8" standalone="yes"?&gt;&lt;event&gt;&lt;body&gt;&amp;amp;lt;UId&amp;amp;gt;904c-be-4e-bbda-3e62&amp;amp;lt;/UId&amp;amp;gt;&amp;amp;lt;&lt;/body&gt;&lt;/event&gt; 2013-04-03 08:55:19,569 INFO [LOGGER] &lt;?xml version="1.0" encoding="UTF-8" standalone="yes"?&gt;&lt;event&gt;&lt;body&gt;&amp;amp;lt;UId&amp;amp;gt;edfc-fr-5e-bced-3443&amp;amp;lt;/UId&amp;amp;gt;&amp;amp;lt;&lt;/body&gt;&lt;/event&gt; $ awk -f script.awk log.file 904c-be-4e-bbda-3e62 0h:0m:20s edfc-fr-5e-bced-3443 0h:0m:45s </code></pre>
    singulars
    1. This table or related slice is empty.
    plurals
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. VO
      singulars
      1. This table or related slice is empty.
    2. VO
      singulars
      1. This table or related slice is empty.
    3. VO
      singulars
      1. This table or related slice is empty.
 

Querying!

 
Guidance

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload