in reply to comb a logfile for time diff and occourance

To start off, I am not claiming that I understand what is expected in the final report. It looks like my code will produce different output to what others have provided.

Secondly, I should say that I have probably misunderstood what is it that you are after. I am seem to be out of tune at the moment.

Third, no attempt has been made to handle timezones.

Forth, the code will build a hash by ref number of each line in the file, so if the log is large or the available memory of the box is small, there could be problems.

Cheers.

#!/usr/bin/env perl use strict; use warnings; use Data::Dumper; use Date::Calc qw( Delta_DHMS ); my %months = ( Jan => 1, Feb => 2, Mar => 3, Apr => 4, May => 5, Jun => 6, Jul => 7, Aug => 8, Sep => 9, Oct => 10, Nov => 11, Dec => 12 ); my %by_ref; my $occured; my @results; push @{ $by_ref{(split)[-1]} }, do { chomp $_; $_ } while (<DATA>); my (%p_date, $p_line, %tmdiff, %date, $r_hash); REF: for my $ref (keys %by_ref) { next unless @{ $by_ref{$ref} } > 1; LINE: for my $line ( @{$by_ref{$ref}} ) { my ($datestr, $time, $chnl) = (split /\s+/, $line)[0,1,9]; next unless $chnl =~ /^TWO/; if (keys %p_date) { $r_hash = \%date; } else { $r_hash = \%p_date; $p_line = $line; } @{$r_hash}{qw/year month day hour min sec/} = split_date($datestr, $time); next unless keys %date; @tmdiff{qw/Dd Dh Dm Ds/} = Delta_DHMS( @p_date{qw/year month day hour min sec/}, @date{qw/year month day hour min sec/} ); if ($tmdiff{Dd} > 0 || $tmdiff{Dh} > 0) { push @results, [ $p_line, $line ]; $occured++; } } } continue { %date = %p_date = (); $p_line = ""; } printf "$occured occurence%s.\n", $occured < 2 ? "" : "s"; print join("\n", @$_),"\n\n" for (@results); sub split_date { my ($datestr, $timestr) = @_; my @fields = split /-/, $datestr; push @fields, split /:/, $timestr; $fields[1] = $months{$fields[1]}; return @fields; } __DATA__ 2008-Jan-06 00:00:01 UTC (GMT +0000) - Poll: channel = ONE, refs = 595 +166299 2007-Jan-06 00:00:01 UTC (GMT +0000) - Poll: channel = TWO, refs = 595 +159906 2007-Jan-06 00:00:01 UTC (GMT +0000) - Poll: channel = THREE, refs = 6 +59975924 2007-Jan-06 00:00:04 UTC (GMT +0000) - Poll: channel = ONE, refs = 595 +148941 2007-Jan-06 00:00:04 UTC (GMT +0000) - Poll: channel = TWO, refs = 595 +131400 2007-Jan-06 00:00:04 UTC (GMT +0000) - Poll: channel = THREE, refs = 6 +59975924 2007-Jan-06 00:00:04 UTC (GMT +0000) - Poll: channel = ONE, refs = 595 +159906 2007-Jan-06 01:00:05 UTC (GMT +0000) - Poll: channel = ONE, refs = 595 +166299 2007-Jan-06 01:00:06 UTC (GMT +0000) - Poll: channel = TWO, refs = 595 +131400 2007-Jan-06 01:00:06 UTC (GMT +0000) - Poll: channel = TWO, refs = 659 +975924 2007-Jan-06 01:00:07 UTC (GMT +0000) - Poll: channel = THREE, refs = 5 +95148941

Output;

1 occurence. 2007-Jan-06 00:00:04 UTC (GMT +0000) - Poll: channel = TWO, refs = 595 +131400 2007-Jan-06 01:00:06 UTC (GMT +0000) - Poll: channel = TWO, refs = 595 +131400