awkForDateTimeRange

awkForDateTimeRange

#!/usr/bin/awk -f

# Formats the timestamp as a number, so that higher numbers represent
# a later timestamp. This will not handle the time zone because date
# can't handle the o'clock notation. I hope all your timestamps use the
# same time zone, otherwise you'll have to hack support for it in here.
# 28/Apr/2017:13:15:16
# date -d '28 Apr 2017 13:15:16' +%d%b%Y:%H:%M:%S

function datefmt(d) {
  # make d compatible with singly-quoted shell strings
  gsub(/'/, "'\\''", d)

  # then run the date command and get its output
  command = "date -d '" d "' +%d%b%Y%H:%M:%S"
  command | getline result
  close(command)

  # that's our result.
  return result;
}

BEGIN {
  # Field separator, so the part of the timestamp we'll parse is in $2 and $3
  #FS = "[< >]+"

  # start, end set here.
  #start = datefmt("28 Apr 2017 12:03:00")
  start = datefmt(STARTTIME)
  #print start
  #end   = datefmt("28 Apr 2017 12:05:59")
  end   = datefmt(ENDTIME)
  #print end
}

{
   #print $4
   split($4,a,"[")
   #print a[1]
   #print a[2]
   split(a[2], b, ":")
   #print b[2] b[3] b[4]
   split(b[1], c, "/")
   #print c[1] c[2] c[3]
   datetime=c[1]" "c[2]" "c[3]" "b[2]":"b[3]":"b[4]
   #print datetime

  # convert the timestamp into an easily comparable format
  stamp = datefmt(datetime)
  #print stamp

  # then print only lines in which the time stamp is in the range.
  if(stamp >= start && stamp <= end) {
    if($0 ~ /com 200/) {
       print $0
    }
  }
}