sarf13 has asked for the wisdom of the Perl Monks concerning the following question:

Input file

DEBUG 29 Apr 2012 23:33:53,428 [Single-Threaded-Persistence] Unpersist +edMessageStore - Firm ==> os7759N DEBUG 29 Apr 2012 23:33:53,428 [Thread:UnprocessedMessageProcessor-] U +nprocessedMessageProcessor - Size of previousOrders : 0 DEBUG 29 Apr 2012 23:34:04,337 [inputAdapterInboundTransportQueueDispa +tcher0] AbstractNonBlockingMessageConsumer - Received message <{ (180 +01)="8=FIX.4.29=10435=A34=15000049=os7759N50=*52=20110131-22:07 +:34.71856=CME57=G95=396=AS0142=DESK12398=0108=301007=21005=Y +1006=25010=203" (18002)="LOGIN_REQUEST" (20002)="101010" (18008)=" +1" (50001)="202020" (18004)="os7759N" (18003)="*" (18009)="null-null- +100" }> DEBUG 29 Apr 2012 23:34:04,417 [WorkerThread : os7759N] ClientResponse +CreatService - User group name : null DEBUG 29 Apr 2012 23:34:04,417 [WorkerThread : os7759N] ClientResponse +CreatService - Re populating REQ Originator 18011 : null DEBUG 29 Apr 2012 23:34:04,419 [WorkerThread : os7759N] ClientResponse +PublisherService - Publish message to Client completed-> [18002]="LOG +IN_ACK" [18003]="*" [18004]="os7759N" [18008]="1" [18009]="null-null- +100" [18010]="LOGIN_REQUEST" [19001]="8=FIX.4.29=10235=A34=049=CM +E50=G52=20120430-04:34:0456=os7759N57=*142=OECLoc143=DESK12336 +9=01001=N1002=Y10=238" [20002]="oecache_primary_dev2" [50001]="fe +dvog01c"

i have to do 3 things

first i need to pic the time value(23:34:04,419) of the line containing "AbstractNonBlockingMessageConsumer - Received message"

second i need to pic the time value value of the line containing "ClientResponsePublisherService - Publish message to Client completed"

then i have to find the diffrence b/t the time

can any one help me out plz.. here i am attaching my code also
#!/usr/bin/perl use strict; use warnings; open (FH ,"C:\\Users\\saahmad\\Desktop\\girish\\oecache_primary_dev2.l +og_bck") or die "$!"; my @new_rm = ""; my @new_rm_id = ""; my $new_rm_id = ""; my @new_pm = ""; my @new_pm_id = ""; my $new_pm_id = ""; my $tag1 = ""; my $tag2 = ""; my @tag18009 = ""; my @time = ""; while (my $line = <FH>) { chomp($line); if ($line =~ "AbstractNonBlockingMessageConsumer - Received messag +e"){ if ($line =~"(18009)") { $tag1 = 1; my @tag18009 = split (" ", $line); my $val_1 = "$tag18009[18]\n"; push (@new_rm_id , "$val_1"); push (@new_rm , "$tag18009[6]\t$tag18009[4]\t$tag18009[18] +\n"); #print "$new_rm[0]"; } } if ($line =~ "ClientResponsePublisherService - Publish message to +Client completed"){ $tag2 = 1; #if ($line =~ "35=8"){ #if ($line =~ "39=0"){ my @time = split (" " , $line); my $val_2 = "$time[20]\n"; push(@new_pm_id , "$val_2"); push(@new_pm , "$time[9]\t$time[4]\t$time[20]\n"); #print "@new_pm====>\n" #} #} } } #print "@new_rm\n"; #print "@new_rm_id\n"; #print "@new_pm\n"; #print "@new_pm_id\n"; for(my $i=0;$i<=scalar(@new_rm_id);$i++){ #print "$new_rm_id[$i]"; if ($new_rm_id[$i] = $new_pm_id[$i]) { print "$new_rm[$i]\n"; } } close (FH);

Replies are listed 'Best First'.
Re: parsing problem
by Anonymous Monk on May 01, 2012 at 08:06 UTC

    Hi :)

    <code></code> tags, they're for both code and DATA

    For date/time regex see Regexp::Common::time

    For some ideas on parsing, see Template::Extract - Use TT2 syntax to extract data from documents

    <p> DEBUG [% count %] [% datetime%],[% seconds %] [[% firstpart %]] [% + rest %] </p>

    So you might write this, esp since your log format seems to be line-oriented

    DEBUG (?<count>\d+) (?<datetime>$reDateTime),(?<seconds>\d+) \[ (?<fir +stpart>[^\]]+)\](?<rest>.*)$

    Things get easier if you can get a hold of the original log format specification, it will resemble the above examples

    pic is short for picture (as in photograph), pick means to choose ( or pierce )

Re: parsing problem
by Marshall (Canon) on May 01, 2012 at 11:25 UTC
    please put your DATA within <code>...</code> tags. I cannot understand it the way it is and I suspect nobody else can either.

    __DATA__ lajkdflkjaf asdfljadsflj uyouir literal data goes here adfafd;kafd;asdf;kads;fk
    redundant with another poster ... ooops.