Question

我有一个以逗号分隔的半径日志文件。

"1/3/2013","00:52:23","NASK","Stop","15444111111","200","15444111111","15444111111","10.142.98.190","moen",,,,,"D89BA1F93E5DC400",,,"31026","216.155.166.8","310260010265999",,"10.184.81.145","780246","18","ATGGSN17","2","7",,,"1385772885",,
"1/3/2013","00:52:23","NASK","Start","15444111111","200","15444111111","15444111111","10.142.98.190","moen",,,,,"D89BA1F93E5DC500",,,"31026","216.155.166.8","310260010265999",,"10.184.81.145","780246","18","A","2","7",,,"1385772885",,

是否可以通过任何Linux命令行工具（如awk）计算第二列（时间）和第七列（数字）相同的出现次数，并且Start事件跟随Stop事件？

我想找到Stop同时跟Start同一个号码的事件。

这些案例之间还会有其他条目和相同的时间戳。

Answer 1

您没有非常清楚地说明您想要什么样的结果，但您应该使用Perl和Text::CSV来处理CSV文件。

此程序只打印事件为Start或Stop的文件的所有行中的三个相关字段，并且时间和ID字符串重复。

use strict;
use warnings;

use Text::CSV;

my $csv = Text::CSV->new;

open my $fh, '<', 'text.csv' or die $!;

my %data;

while (my $row = $csv->getline($fh)) {
  my ($time, $event, $id) = @$row[1,3,6];
  next unless $event eq 'Start' or $event eq 'Stop';
  push @{ $data{"$time/$id"} }, $row;
}

for my $lines (values %data) {
  next unless @$lines > 1;
  print "@{$_}[1,3,6]\n" for @$lines;
  print "\n";
}

<强>输出

00:52:23 Stop 15444111111
00:52:23 Start 15444111111

Answer 2

如果“停止”行后面紧跟“开始”行，您可以尝试以下操作：

awk -f cnt.awk input.txt

其中cnt.awk是

BEGIN {
    FS=","
}

$4=="\"Stop\"" {
    key=($2 $5)
    startl=$0
    getline
    if ($4=="\"Start\"") {
        if (key==($2 $5)) {
           print startl
           print $0
        }
    }
}

更新

如果“开始”和“停止”行之间可能有其他行，您可以尝试：

BEGIN {
    FS=","
}
$4=="\"Stop\"" {
    a[($2 $5)]=$0
    next
}

$4=="\"Start\"" {
    key=($2 $5)
    if (key in a) {
        sl[++i]=a[key]
        el[i]=$0
    }
}

END {
    nn=i
    for (i=1; i<=nn; i++) {
        print sl[i]
        print el[i]
    }
}

Answer 3

我尝试使用GNU sed＆amp; AWK

sed -n '/Stop/,/Start/{/Stop/{h};/Start/{H;x;p}}' text.csv \
| awk -F, 'NR%2 != 0 {prev=$0;time=$2;num=$7}  \
           NR%2 == 0 {if($2==time && $7==num){print prev,"\n", $0}}'

sed部分会选择配对停止行和开始行。两行之间可以（或不存在）其他行，如果开始行之前有多个停止行，则最后停止行将被选中（在这种情况下可能没有必要......）。

awk部分将比较sed部分中的选定对，如果第二列和第七列相同，则该对将打印出来。

我的测试如下：

text.csv：

"1/3/2013","00:52:20","NASK","Stop","15444111111","200","15444111111","15444111111","10.142.98.190","moen",,,,,"D89BA1F93E5DC400",,,"31026","216.155.166.8","310260010265999",,"10.184.81.145","780246","18","ATGGSN17","2","7",,,"1385772885",,
"1/3/2013","00:52:23","NASK","XXXX","15444111111","200","15444111111","15444111111","10.142.98.190","moen",,,,,"D89BA1F93E5DC400",,,"31026","216.155.166.8","310260010265999",,"10.184.81.145","780246","18","ATGGSN17","2","7",,,"1385772885",,
"1/3/2013","00:52:23","NASK","Stop","15444111111","200","15444111111","15444111111","10.142.98.190","moen",,,,,"D89BA1F93E5DC400",,,"31026","216.155.166.8","310260010265999",,"10.184.81.145","780246","18","ATGGSN17","2","7",,,"1385772885",,
"1/3/2013","00:52:23","NASK","XXXX","15444111111","200","15444111111","15444111111","10.142.98.190","moen",,,,,"D89BA1F93E5DC400",,,"31026","216.155.166.8","310260010265999",,"10.184.81.145","780246","18","ATGGSN17","2","7",,,"1385772885",,
"1/3/2013","00:52:23","NASK","Start","15444111111","200","15444111111","15444111111","10.142.98.190","moen",,,,,"D89BA1F93E5DC500",,,"31026","216.155.166.8","310260010265999",,"10.184.81.145","780246","18","A","2","7",,,"1385772885",,
"1/3/2013","00:52:28","NASK","Stop","15444111111","200","15444111111","15444111111","10.142.98.190","moen",,,,,"D89BA1F93E5DC400",,,"31026","216.155.166.8","310260010265999",,"10.184.81.145","780246","18","ATGGSN17","2","7",,,"1385772885",,
"1/3/2013","00:52:29","NASK","Start","15444111111","200","15444111111","15444111111","10.142.98.190","moen",,,,,"D89BA1F93E5DC500",,,"31026","216.155.166.8","310260010265999",,"10.184.81.145","780246","18","A","2","7",,,"1385772885",,

输出：

"1/3/2013","00:52:23","NASK","Stop","15444111111","200","15444111111","15444111111","10.142.98.190","moen",,,,,"D89BA1F93E5DC400",,,"31026","216.155.166.8","310260010265999",,"10.184.81.145","780246","18","ATGGSN17","2","7",,,"1385772885",, 
"1/3/2013","00:52:23","NASK","Start","15444111111","200","15444111111","15444111111","10.142.98.190","moen",,,,,"D89BA1F93E5DC500",,,"31026","216.155.166.8","310260010265999",,"10.184.81.145","780246","18","A","2","7",,,"1385772885",,

根据时间和ID在日志文件中查找匹配项

3 个答案:

更新