Question

拥有此日志文件

20180917084726:-
20180917085418:[111783178, 111557953, 111646835, 111413356, 111412662, 105618372, 111413557]
20180917115418:[111413432, 111633904, 111783198, 111792767, 111557948, 111413225, 111413281]
20180917105419:[111413432, 111633904, 111783198, 111792767, 111557948, 111413225, 111413281]
20180917085522:[111344871, 111394583, 111295547, 111379566, 111352520]
20180917090022:[111344871, 111394583, 111295547, 111379566, 111352520]

输入日志的格式为：

时间戳的格式为YYYYMMDDhhmmss

我想知道如何编写一个脚本，该脚本在一天中每十分钟的片中返回的唯一ID计数输出一行

结果如下：

20180917084:0
20180917085:12
20180917115:7
20180917105:7

Answer 1

awk：使用冒号或逗号作为字段分隔符。

awk -F '[,:]' '
    {
        key = substr($1,1,11)"0"
        count[key] += ($2 == "-" ? 0 : NF-1)
    } 
    END {
        PROCINFO["sorted_in"] = "@ind_num_asc"
        for (key in count) print key, count[key]
    }
' file

201809170840 0
201809170850 12
201809170900 5
201809171050 7
201809171150 7

要过滤今天的日期，您可以说：

gawk -F '[,:]' '
    BEGIN {today = strftimme("%Y%m%d", systime())}
    $0 ~ "^"today { key = ...

或

awk -F '[,:]' -v "today=$(date "+%Y%m%d")" '
    $0 ~ "^"today { key = ...

或将现有的awk代码通过管道传递到| grep "^$(date +%Y%m%d)"

Answer 2

能否请您尝试以下操作，它将按照在Input_file中发生时间戳的相同顺序为您提供输出。

awk '
{
  val=substr($0,1,11)
}
!a[val]++{
  b[++count]=val
}
match($0,/\[.*\]/){
  num=split(substr($0,RSTART,RLENGTH),array,",")
  c[val]+=num
}
END{
  for(i=1;i<=count;i++){
    print b[i],c[b[i]]+0
  }
}'   Input_file

输出如下。

20180917084 0
20180917085 12
20180917115 7
20180917105 7
20180917090 5

编辑： ：如果您的任何字段的值均为NULL，请添加解决方案，因此现在也请检查上面的代码。

awk '
{
  val=substr($0,1,11)
}
!a[val]++{
  b[++count]=val
}
match($0,/\[.*\]/){
  count1=""
  num=split(substr($0,RSTART,RLENGTH),array,",")
  for(j=1;j<=num;j++){
    if(array[j]){
      count1++
    }
  }
  c[val]+=count1
}
END{
  for(i=1;i<=count;i++){
    print b[i],c[b[i]]+0
  }
}'  Input_file

Answer 3

your input and output are not consistent but I guess you want something like this

 $ awk -F: '{k=sprintf("%10d",$1/1000); n=gsub(",",",",$2); a[k]+=(n?n+1:n)} 
        END {for(k in a) print k":"a[k] | "sort" }' file 

20180917084:0
20180917085:12
20180917090:5
20180917105:7
20180917115:7

Answer 4

抢救Perl！

perl -ne '
    ($timestamp, @ids) = /([0-9]+)/g;
    substr $timestamp, -3, 3, "";
    @{ $seen{$timestamp} }{@ids} = ();
    END {
        for my $timestamp (sort keys %seen) {
            print "$timestamp:", scalar keys %{ $seen{$timestamp} }, "\n";
        }
    }' < file.log

-n逐行读取输入
substr在这里用空字符串替换时间戳的后三个字符
%seen是哈希的哈希，对于每个时间戳，内部哈希记录看到的ID
keys在标量上下文中返回键的计数，在这种情况下，是每个时间戳的唯一ID数。

Bash脚本，每十分钟在方括号中计数一次ID

4 个答案: