Hi, if the format used for the date in each line is the same, I suggest you parse the dates and sort by comparing them either as epoch values or with a built comparator, eg using DateTime or the core module Time::Piece.

Update: Here's a slightly silly example. (It's silly because you shouldn't be using a string sort for this, but rather, offloading the log entries into a database (eg using DBD::SQLite) and doing your sorting there.)

Parsing the dates each time the sort sub made a comparison would be grossly inefficient so I replace them with epoch values and then revert after the sort. This is not to say that sorting with a sub that uses regular expressions is not also hugely inefficient ;-) 

use strict; use warnings; use feature 'say';
use Time::Piece;
use Data::Dumper;

my $fmt = '%a %b %d %T %Y';

say for map {
    s/
      (?<=TIMESTAMP=) (\d+)
    /
      localtime($1)->strftime($fmt)
    /arex
} sort {
    ($a =~ /(?<=TIMESTAMP=) (\d+)/ax)[0] <=> ($b =~ /(?<=TIMESTAMP=) (
+\d+)/ax)[0]
} map {
    chomp;
    s/
      (?<=TIMESTAMP=) (\w+\s+\w+\s+\d+\s+\d+:\d+:\d+\s+\d+)
    /
      Time::Piece->strptime($1, $fmt)->epoch
    /arex
} <DATA>;

__END__
...bla TIMESTAMP=Wed Oct  5 04:08:28 2018 bla...
...bla TIMESTAMP=Fri Nov  2 14:11:28 2018 bla...
...bla TIMESTAMP=Tue Oct 16 17:10:00 2018 bla...
...bla TIMESTAMP=Fri Nov  2 14:11:03 2018 bla...

[download]
Output: 
$ perl 1225106.pl
...bla TIMESTAMP=Fri Oct 05 00:08:28 2018 bla...
...bla TIMESTAMP=Tue Oct 16 13:10:00 2018 bla...
...bla TIMESTAMP=Fri Nov 02 10:11:03 2018 bla...
...bla TIMESTAMP=Fri Nov 02 10:11:28 2018 bla...

[download]

Hope this helps!



The way forward always starts with a minimal test.

In reply to Re: Merge 2 or more logs, sort by date & time by 1nickt
in thread Merge 2 or more logs, sort by date & time by ImJustAFriend

Title:
Use:  <p> text here (a paragraph) </p>
and:  <code> code here </code>
to format your post, it's "PerlMonks-approved HTML":


  • Posts are HTML formatted. Put <p> </p> tags around your paragraphs. Put <code> </code> tags around your code and data!
  • Titles consisting of a single word are discouraged, and in most cases are disallowed outright.
  • Read Where should I post X? if you're not absolutely sure you're posting in the right place.
  • Please read these before you post! —
  • Posts may use any of the Perl Monks Approved HTML tags:
    a, abbr, b, big, blockquote, br, caption, center, col, colgroup, dd, del, details, div, dl, dt, em, font, h1, h2, h3, h4, h5, h6, hr, i, ins, li, ol, p, pre, readmore, small, span, spoiler, strike, strong, sub, summary, sup, table, tbody, td, tfoot, th, thead, tr, tt, u, ul, wbr
  • You may need to use entities for some characters, as follows. (Exception: Within code tags, you can put the characters literally.)
            For:     Use:
    & &amp;
    < &lt;
    > &gt;
    [ &#91;
    ] &#93;
  • Link using PerlMonks shortcuts! What shortcuts can I use for linking?
  • See Writeup Formatting Tips and other pages linked from there for more info.